net/mail: golang: net/mail: Denial of Service via pathological email address parsing

🗓️ 08 Sep 2026 09:10:47Reported by RedHatType

redhat🔗 access.redhat.com👁 3 Views

DoS in Go net/mail via quadratic string concatenation in consumePhrase parsing email addresses.

Reporter	Title	Published	Views	Family All 8204
OSV	CGA-7H7M-GCGH-2VWP	9 May 202611:22	–	osv
OSV	CGA-7H7V-R355-8964	9 May 202602:20	–	osv
OSV	CGA-7H92-6VP7-R4GQ	9 May 202601:35	–	osv
OSV	CGA-7HGJ-5QV7-75PQ	18 Jun 202600:44	–	osv
OSV	CGA-7HGQ-R664-RFR4	9 May 202612:37	–	osv
OSV	CGA-7HJ4-MC5J-W9MQ	9 May 202600:52	–	osv
OSV	CGA-7HP6-8V3G-JHGG	18 Jun 202601:15	–	osv
OSV	CGA-7HQ4-H72C-FX3R	9 May 202600:39	–	osv
OSV	CGA-7HQW-HW9M-F3RR	9 May 202601:01	–	osv
OSV	CGA-7HR6-5G6R-47QG	9 May 202611:43	–	osv

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	10.2	aarch64	opentelemetry-collector	0.152.1-2.el10_2	opentelemetry-collector-0.152.1-2.el10_2.aarch64.rpm
Red Hat Enterprise Linux	10.2	ppc64le	opentelemetry-collector	0.152.1-2.el10_2	opentelemetry-collector-0.152.1-2.el10_2.ppc64le.rpm
Red Hat Enterprise Linux	10.2	s390x	opentelemetry-collector	0.152.1-2.el10_2	opentelemetry-collector-0.152.1-2.el10_2.s390x.rpm
Red Hat Enterprise Linux	10.2	x86_64	opentelemetry-collector	0.152.1-2.el10_2	opentelemetry-collector-0.152.1-2.el10_2.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-42499
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/771520
go	www.go.dev/issue/78987
groups	www.groups.google.com/g/golang-announce/c/qcCIEXso47M
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42499
pkg	www.pkg.go.dev/vuln/GO-2026-4977
cve	www.cve.org/CVERecord

09 Sep 2026 00:45Current

CVSS 3.17.5

EPSS0.00798

SSVC

Go net/mail Denial of Service quadratic concatenation email parsing consumePhrase resource exhaustion