Executive brief
A vulnerability in the Go programming language's email parsing library can allow an attacker to crash or slow down applications that process email addresses. By sending a specially crafted, complex email address, an attacker can trigger an inefficient computing process that consumes excessive system resources. This can lead to a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.
Technical details
A denial of service (DoS) vulnerability exists in the Go standard library's 'net/mail' package due to quadratic string concatenation in the 'consumePhrase' function. When parsing email addresses according to RFC 5322, certain pathological inputs can trigger inefficient resource consumption. An unauthenticated remote attacker can exploit this by providing a specially crafted email address to functions such as ParseAddress or AddressList. This results in a CPU-based denial of service. The issue is fixed in Go versions 1.25.10 and 1.26.3.
Affected products
- Google Go before 1.25.10, 1.26.0 to 1.26.3
- Red Hat OpenShift Service Mesh 3.0, 3.1, 3.2, 3.3
Timeline
- 2026-04-28: disclosed: Issue opened on Go GitHub repository
- 2026-05-07: advisory: NVD and Go vulnerability report published
- 2026-06-29: patched: Red Hat released security advisories for OpenShift Service Mesh