CVE-2026-39820
Quadratic string concatentation in consumeComment in net/mail
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
| Vendor | go standard library |
| Product | net/mail |
| Published | May 7, 2026 |
| Last Updated | Aug 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for go standard library net/mail
Be the first to know when new high vulnerabilities affecting go standard library net/mail are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Go standard library / net/mail
0 < 1.25.10 1.26.0-0 < 1.26.3
References
go.dev: https://go.dev/issue/78566 go.dev: https://go.dev/cl/759940 groups.google.com: https://groups.google.com/g/golang-announce/c/qcCIEXso47M pkg.go.dev: https://pkg.go.dev/vuln/GO-2026-4986 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-39820 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2467820 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:47952 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34364 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:43692 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36319 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36625 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36754 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33574 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:23262 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:23264 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41928 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:50300 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:43038 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42644 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33120 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33123 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33142 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33150 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:50205 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42146 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:43052 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42796 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41066 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41031 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40262 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36797
Credits
thatnealpatel