CVE-2026-42499
Quadratic string concatenation in consumePhrase in net/mail
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
| Vendor | go standard library |
| Product | net/mail |
| Published | May 7, 2026 |
| Last Updated | Aug 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for go standard library net/mail
Be the first to know when new high vulnerabilities affecting go standard library net/mail are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Go standard library / net/mail
0 < 1.25.10 1.26.0-0 < 1.26.3
References
go.dev: https://go.dev/issue/78987 go.dev: https://go.dev/cl/771520 groups.google.com: https://groups.google.com/g/golang-announce/c/qcCIEXso47M pkg.go.dev: https://pkg.go.dev/vuln/GO-2026-4977 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-42499 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2467809 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:47952 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34364 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:43692 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36319 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36625 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36754 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33574 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17713 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17714 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41928 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:50300 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:43038 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42644 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33120 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33123 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33142 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33150 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42146 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:43052 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42796 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41066 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41031 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40262 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36797