CVE-2026-42499: Quadratic string concatenation in consumePhrase in net/mail
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
Other sources
Quadratic string concatenation in consumePhrase in net/mail
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.25.10-r0 - Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.3-r0 - Upgrade
Upgrade
alpine/rcloneto a version that resolves this vulnerability.Fixed in 1.74.1-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42499?
CVE-2026-42499 is classified as a potential DoS vulnerability due to quadratic string concatenation in email address parsing.
How do I fix CVE-2026-42499?
To fix CVE-2026-42499, update your Go net/mail package to the latest version as recommended by the maintainers.
What type of vulnerability is CVE-2026-42499?
CVE-2026-42499 is a denial of service (DoS) vulnerability related to the parsing of email addresses based on RFC 5322.
Which software is affected by CVE-2026-42499?
CVE-2026-42499 affects the Go net/mail package specifically.
What are the potential impacts of CVE-2026-42499?
The potential impacts of CVE-2026-42499 include service disruption and degraded performance due to excessive resource consumption during email parsing.