Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-42499

Quadratic string concatenation in consumePhrase in net/mail

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library net/mail

Default version status: unaffected

  • 0 to < 1.25.10affected
  • 1.26.0-0 to < 1.26.3affected

References