Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-39820

Quadratic string concatentation in consumeComment in net/mail

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library net/mail

Default version status: unaffected

  • 0 to < 1.25.10affected
  • 1.26.0-0 to < 1.26.3affected

References