← CVE Intelligence

CVE-2026-39820

Quadratic string concatentation in consumeComment in net/mail PUBLISHED

Description (CNA)

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Affected (CNA)

Vendor / productVersions
Go standard library / net/mailaffected 0 before 1.25.10; affected 1.26.0-0 before 1.26.3

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.