Skip to main content

Go net/mail CVE-2026-39820

| EUVDEUVD-2026-28423 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-05-07 Go GHSA-p9h5-jm8x-mjm5
Denial Of Service Net Mail Go Standard Library
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send crafted email address to parsing endpoint
  2. Delivery
    Trigger ParseAddress/ParseAddressList
  3. Exploit
    Exhaust CPU and memory resources
  4. Execution
    Service becomes unresponsive
  5. Impact
    Denial of service achieved

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target application to invoke ParseAddress, ParseAddressList, or ParseDate functions from Go's net/mail package on attacker-controlled input data. Specifically affected are Go applications that accept email addresses or date strings from network sources (HTTP APIs, SMTP servers, message queues) and pass them to these parsing functions without preprocessing resource limits. The vulnerability is exploitable in default configurations against any Go application compiled with versions prior to 1.25.10 or 1.26.0-1.26.2 that exposes these parsing operations to external input. Attack complexity is low (AC:L) with no authentication required (PR:N), meaning any network-accessible endpoint invoking these functions on untrusted data is vulnerable. Applications that parse only pre-validated or length-limited email data, or those operating behind rate limiting or resource quotas, have reduced exposure. Services processing internal-only or authenticated email sources face lower risk than internet-facing systems accepting arbitrary email input.
Impact

Real-world risk is moderate despite the 7.5 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates straightforward network-based exploitation requiring no authentication or user interaction, enabling remote attackers to trigger denial of service. However, EPSS score of 0.02% (5th percentile) suggests extremely low observed exploitation activity in the wild, indicating this is not being actively weaponized at scale. The vulnerability is limited to availability impact (A:H) with no confidentiality or integrity compromise, and scope is unchanged (S:U), meaning the DoS affects only the vulnerable component. Attack complexity is low, suggesting reliable exploitation once the parsing functions are reachable. Primary risk surfaces are internet-facing services that parse external email data: mail servers, email validation APIs, contact form processors, and email archival systems. Internal applications parsing only trusted email sources face significantly lower risk. The availability of vendor patches in Go 1.25.10 and 1.26.3 with low EPSS score suggests this is a priority for affected systems but not an emergency requiring immediate out-of-band patching for most organizations. Services with high availability requirements or those processing untrusted email at scale should prioritize remediation.
Exploit ScenarioDerived

An attacker identifies a public-facing email validation API built with Go that uses net/mail.ParseAddress to validate user-submitted email addresses. They craft a specially formatted email address string designed to trigger the algorithmic complexity flaw and submit it via HTTP POST to the validation endpoint. The ParseAddress function consumes excessive CPU cycles and allocates large amounts of memory attempting to parse the malicious input. By sending multiple concurrent requests with crafted inputs, the attacker exhausts server resources, causing the validation service to become unresponsive and denying service to legitimate users. No public exploit code confirmed at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 08, 2026

Denial of service in Go standard library net/mail package allows remote unauthenticated attackers to exhaust CPU and memory resources via maliciously crafted email addresses or dates. The vulnerability affects ParseAddress, ParseAddressList, and ParseDate functions in Go versions prior to 1.25.10 and 1.26.0-1.26.2. Confirmed actively exploited (CISA KEV status not indicated; exploitation probability 0.02% per EPSS). Vendor-released patches available in Go 1.25.10 and 1.26.3.

RemediationAI

Upgrade to Go 1.26.3 or Go 1.25.10 which contain fixes for the resource exhaustion issue in net/mail parsing functions. Recompile all affected applications with the patched Go version to incorporate the standard library fix. For applications that cannot immediately upgrade, implement rate limiting on email parsing operations to restrict the number of ParseAddress, ParseAddressList, and ParseDate calls per client or time window (trade-off: legitimate high-volume email processing may be impacted). Deploy resource constraints using cgroups or container limits to cap CPU and memory consumption for processes handling email parsing (trade-off: may cause parsing failures under legitimate load spikes). Consider input validation to reject email addresses or date strings exceeding reasonable length thresholds before passing to parsing functions (trade-off: may block legitimate but unusual RFC 5322-compliant formats). Vendor advisory: https://groups.google.com/g/golang-announce/c/qcCIEXso47M. Patch implementation details: https://go.dev/cl/759940.

Affected VersionsENISA

net/mail 1.26.0-0 <1.26.3
net/mail 0 <1.25.10

Affected Packages

go stdlib fix: 1.25.10, 1.26.3
euvd net_mail fix: 1.25.10, 1.26.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Go standard library's net/mail package provides RFC 5322-compliant parsing of email messages, addresses, and date formats. This vulnerability resides in three parsing functions (ParseAddress, ParseAddressList, ParseDate) that process external email data. When these functions encounter specially crafted inputs, they trigger algorithmic complexity issues leading to excessive CPU consumption and uncontrolled memory allocation. The affected CPE (cpe:2.3:a:go_standard_library:net/mail) indicates this is a core standard library component used by any Go application that parses email messages or headers. The vulnerability class appears to involve resource exhaustion through crafted input, though no CWE mapping was provided. This affects applications using these functions to parse untrusted email data from network sources, SMTP servers, IMAP/POP3 clients, email parsing APIs, or any system ingesting email addresses or date headers.

Know when Net Mail gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
May 08, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
May 07, 2026 - 21:02 EUVD
CVE Published
May 07, 2026 - 19:41 nvd
UNKNOWN (no severity yet)
CVE Published
May 07, 2026 - 19:41 nvd
HIGH 7.5

DescriptionNVD

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Executive ViewAI

Why It Matters

Go standard library versions prior to 1.25.10 and 1.26.3 contain a denial-of-service vulnerability in email parsing functions that allows remote attackers to crash applications by consuming CPU and memory resources with malformed email addresses or dates. Organizations running Go-based services-particularly those processing untrusted email input-face service availability risk and potential operational disruption without immediate patching.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible, implement rate limiting and input validation on email address and date parsing endpoints to reduce DoS surface; isolate or restrict untrusted email input sources pending upgrade to Go 1.25.10 or 1.26.3.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Exploit
POC
Public exploit code exists
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Net Mail

View all
CVE-2026-42499 HIGH POC
7.5 May 07

Denial of service in the Go standard library's net/mail package allows remote attackers to exhaust CPU or memory by subm

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:37276 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-39820 ADVISORY https://vuldb.com/vuln/361954 REF https://access.redhat.com/errata/RHSA-2026:22112 REF https://access.redhat.com/errata/RHSA-2026:22120 REF https://access.redhat.com/errata/RHSA-2026:22121 REF https://access.redhat.com/errata/RHSA-2026:23262 REF https://access.redhat.com/errata/RHSA-2026:23264 REF https://access.redhat.com/errata/RHSA-2026:33120 REF https://access.redhat.com/errata/RHSA-2026:33123 REF https://access.redhat.com/errata/RHSA-2026:33142 REF https://access.redhat.com/errata/RHSA-2026:33150 REF https://access.redhat.com/errata/RHSA-2026:33574 REF https://access.redhat.com/errata/RHSA-2026:34364 REF https://access.redhat.com/errata/RHSA-2026:36319 REF https://access.redhat.com/errata/RHSA-2026:36625 REF https://access.redhat.com/errata/RHSA-2026:36754 REF https://access.redhat.com/errata/RHSA-2026:36797 REF https://access.redhat.com/errata/RHSA-2026:40262 REF https://access.redhat.com/errata/RHSA-2026:41031 REF https://access.redhat.com/errata/RHSA-2026:41066 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:42146 REF https://access.redhat.com/errata/RHSA-2026:42644 REF https://access.redhat.com/errata/RHSA-2026:42796 REF https://access.redhat.com/errata/RHSA-2026:43038 REF https://access.redhat.com/errata/RHSA-2026:43052 REF https://access.redhat.com/errata/RHSA-2026:43692 REF https://access.redhat.com/errata/RHSA-2026:47952 REF https://access.redhat.com/errata/RHSA-2026:49702 REF https://access.redhat.com/errata/RHSA-2026:49712 REF https://access.redhat.com/errata/RHSA-2026:50205 REF https://access.redhat.com/errata/RHSA-2026:50300 REF https://access.redhat.com/errata/RHSA-2026:50319 REF https://access.redhat.com/errata/RHSA-2026:50336 REF https://access.redhat.com/errata/RHSA-2026:50843 REF https://access.redhat.com/errata/RHSA-2026:51033 REF https://access.redhat.com/errata/RHSA-2026:51112 REF https://access.redhat.com/errata/RHSA-2026:54274 REF https://access.redhat.com/errata/RHSA-2026:54283 REF https://access.redhat.com/errata/RHSA-2026:54284 REF https://access.redhat.com/errata/RHSA-2026:54285 REF https://access.redhat.com/errata/RHSA-2026:54286 REF https://access.redhat.com/errata/RHSA-2026:54287 REF https://access.redhat.com/errata/RHSA-2026:54531 REF https://access.redhat.com/errata/RHSA-2026:54552 REF https://access.redhat.com/errata/RHSA-2026:54555 REF https://access.redhat.com/errata/RHSA-2026:54583 REF https://access.redhat.com/errata/RHSA-2026:54602 REF https://access.redhat.com/errata/RHSA-2026:54883 REF https://access.redhat.com/errata/RHSA-2026:56340 REF https://access.redhat.com/errata/RHSA-2026:56789 REF https://access.redhat.com/errata/RHSA-2026:56852 REF https://access.redhat.com/errata/RHSA-2026:56854 REF https://access.redhat.com/errata/RHSA-2026:57194 REF https://access.redhat.com/errata/RHSA-2026:57401 REF https://access.redhat.com/errata/RHSA-2026:57482 REF https://access.redhat.com/errata/RHSA-2026:57487 REF https://access.redhat.com/errata/RHSA-2026:57649 REF https://access.redhat.com/errata/RHSA-2026:57845 REF https://access.redhat.com/errata/RHSA-2026:57914 REF https://access.redhat.com/errata/RHSA-2026:59467 REF https://access.redhat.com/errata/RHSA-2026:59830 REF https://access.redhat.com/errata/RHSA-2026:59833 REF https://access.redhat.com/errata/RHSA-2026:60018 REF https://access.redhat.com/errata/RHSA-2026:60023 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:61253 REF https://access.redhat.com/errata/RHSA-2026:62260 REF https://access.redhat.com/errata/RHSA-2026:62406 REF https://access.redhat.com/errata/RHSA-2026:62407 REF https://access.redhat.com/errata/RHSA-2026:62753 REF https://access.redhat.com/errata/RHSA-2026:62754 REF https://access.redhat.com/errata/RHSA-2026:62803 REF https://access.redhat.com/errata/RHSA-2026:63022 REF https://access.redhat.com/errata/RHSA-2026:65116 REF https://access.redhat.com/errata/RHSA-2026:65117 REF https://access.redhat.com/errata/RHSA-2026:65153 REF https://access.redhat.com/errata/RHSA-2026:65335 REF https://access.redhat.com/errata/RHSA-2026:65336 REF https://access.redhat.com/errata/RHSA-2026:65534 REF https://access.redhat.com/errata/RHSA-2026:65838 REF https://access.redhat.com/errata/RHSA-2026:65886 REF https://access.redhat.com/errata/RHSA-2026:65895 REF https://access.redhat.com/errata/RHSA-2026:66016 REF https://access.redhat.com/errata/RHSA-2026:66022 REF https://access.redhat.com/errata/RHSA-2026:66327 REF https://access.redhat.com/errata/RHSA-2026:67517 REF https://access.redhat.com/errata/RHSA-2026:67974 REF https://access.redhat.com/errata/RHSA-2026:67975 REF https://access.redhat.com/errata/RHSA-2026:68334 REF https://access.redhat.com/errata/RHSA-2026:68504 REF https://access.redhat.com/errata/RHSA-2026:68527 REF https://access.redhat.com/security/cve/CVE-2026-39820 REF https://bugzilla.redhat.com/show_bug.cgi?id=2467820 REF https://go.dev/cl/759940 REF https://go.dev/issue/78566 REF https://groups.google.com/g/golang-announce/c/qcCIEXso47M REF https://pkg.go.dev/vuln/GO-2026-4986 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy