Go standard library Net/mail vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Go standard library Net/mail: 3 record(s), with affected versions and fixes.

CVE-2026-42499 High · 7.5 CWE-1046 May 7, 2026

Quadratic string concatenation in consumePhrase in net/mail

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

CVE-2026-39820 High · 7.5 CWE-770 May 7, 2026

Quadratic string concatentation in consumeComment in net/mail

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

CVE-2025-61725 High · 7.5 Oct 29, 2025

Excessive CPU consumption in ParseAddress in net/mail

The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.