CVE-2026-42499: Quadratic string concatenation in consumePhrase in net/mail
Published May 7, 2026
·Updated
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
Affected Software
3 affected components
go net/mail
Golang Go<1.25.10
Golang Go>=1.26.0<1.26.3
Remediation
Patch Available
Event History
May 7, 2026
CVE Published
via MITRE·07:41 PM
Data Sourced
via MITRE·07:41 PM
DescriptionWeakness
Data Sourced
via NVD·08:16 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-42499?
CVE-2026-42499 is classified as a potential DoS vulnerability due to quadratic string concatenation in email address parsing.
2
How do I fix CVE-2026-42499?
To fix CVE-2026-42499, update your Go net/mail package to the latest version as recommended by the maintainers.
3
What type of vulnerability is CVE-2026-42499?
CVE-2026-42499 is a denial of service (DoS) vulnerability related to the parsing of email addresses based on RFC 5322.
4
Which software is affected by CVE-2026-42499?
CVE-2026-42499 affects the Go net/mail package specifically.
5
What are the potential impacts of CVE-2026-42499?
The potential impacts of CVE-2026-42499 include service disruption and degraded performance due to excessive resource consumption during email parsing.