CVE-2026-39820: Quadratic string concatentation in consumeComment in net/mail
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39820?
CVE-2026-39820 is classified as a moderate severity vulnerability due to its potential for CPU exhaustion and memory allocation issues.
How do I fix CVE-2026-39820?
To fix CVE-2026-39820, update the golang/net/mail package to the latest version where the vulnerability has been addressed.
What impact does CVE-2026-39820 have on system performance?
CVE-2026-39820 can lead to significant performance degradation, causing excessive CPU usage and memory allocation during specific input handling.
Which versions of golang/net/mail are affected by CVE-2026-39820?
CVE-2026-39820 affects older versions of the golang/net/mail package prior to the vulnerability fix in later updates.
Can CVE-2026-39820 be exploited remotely?
Yes, CVE-2026-39820 can potentially be exploited remotely if an attacker sends specially crafted inputs to the affected functions.