CVE-2026-42499: Quadratic string concatenation in consumePhrase in net/mail
Published May 7, 2026
·Updated
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
Other sources
Quadratic string concatenation in consumePhrase in net/mail
— Microsoft
Affected Software
3 affected components
go net/mail
Golang Go<1.25.10
Golang Go>=1.26.0<1.26.3
Remediation
Patch Available
Event History
May 7, 2026
CVE Published
via MITRE·07:41 PM
Data Sourced
via MITRE·07:41 PM
DescriptionWeakness
Data Sourced
via Red Hat·08:01 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·08:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
May 10, 2026
Data Sourced
via Microsoft·08:03 AM
DescriptionSeverityWeakness
Aug 5, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-42499?
CVE-2026-42499 is classified as a potential DoS vulnerability due to quadratic string concatenation in email address parsing.
2
How do I fix CVE-2026-42499?
To fix CVE-2026-42499, update your Go net/mail package to the latest version as recommended by the maintainers.
3
What type of vulnerability is CVE-2026-42499?
CVE-2026-42499 is a denial of service (DoS) vulnerability related to the parsing of email addresses based on RFC 5322.
4
Which software is affected by CVE-2026-42499?
CVE-2026-42499 affects the Go net/mail package specifically.
5
What are the potential impacts of CVE-2026-42499?
The potential impacts of CVE-2026-42499 include service disruption and degraded performance due to excessive resource consumption during email parsing.