← CVE Intelligence

CVE-2026-42499

Quadratic string concatenation in consumePhrase in net/mail PUBLISHED

Description (CNA)

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Affected (CNA)

Vendor / productVersions
Go standard library / net/mailaffected 0 before 1.25.10; affected 1.26.0-0 before 1.26.3

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.