CVE-2026-42499

Quadratic string concatenation in consumePhrase in net/mail

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

*Credits: N/A

CVSS Scores

CISAv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2026-04-28 CVE Reserved
2026-05-07 CVE Published
2026-05-13 CVE Updated
2026-05-14 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (4)

URL	Tag	Source
https://go.dev/issue/78987	Issue Tracking
https://groups.google.com/g/golang-announce/c/qcCIEXso47M	Release Notes

URL	Date	SRC

URL	Date	SRC
https://go.dev/cl/771520	2026-05-08

URL	Date	SRC
https://pkg.go.dev/vuln/GO-2026-4977	2026-05-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Golang Search vendor "Golang"		Go Search vendor "Golang" for product "Go"				< 1.25.10 Search vendor "Golang" for product "Go" and version " < 1.25.10"		-		Affected
Golang Search vendor "Golang"		Go Search vendor "Golang" for product "Go"				>= 1.26.0 < 1.26.3 Search vendor "Golang" for product "Go" and version " >= 1.26.0 < 1.26.3"		-		Affected