Executive brief
A vulnerability in the Go programming language's standard library can allow an attacker to crash or slow down applications that process email addresses or dates. By sending specially crafted email headers, an attacker can force the system to consume excessive processor power and memory. This can lead to a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.
Technical details
A denial of service vulnerability exists in the Go standard library's net/mail package. The functions ParseAddress, ParseAddressList, and ParseDate (and their associated methods) fail to properly handle certain malformed inputs, leading to quadratic complexity during comment consumption. An unauthenticated remote attacker can exploit this by providing specially crafted email headers, resulting in excessive CPU consumption and memory allocation. The issue is tracked in the Go project as issue 78566 and has been patched in Go versions 1.25.10 and 1.26.3.
Affected products
- Google Go before 1.25.10, from 1.26.0-0 before 1.26.3
- Red Hat OpenShift Service Mesh 3.0, 3.1, 3.2, 3.3
Timeline
- 2026-04-07: disclosed: Issue opened in Go project repository
- 2026-05-07: advisory: Published in Go vulnerability database and NVD
- 2026-06-29: patched: Red Hat released security advisories for affected products