Go net/mail CVE-2026-42499

Vendor-released patch: upgrade the Go toolchain to 1.26.3 (for the 1.26.x line) or 1.25.10 (for 1.25.x and earlier) and rebuild affected applications, as announced at https://groups.google.com/g/golang-announce/c/qcCIEXso47M with details at https://go.dev/issue/78987 and fix https://go.dev/cl/771520. Red Hat users should apply the corresponding errata (e.g., RHSA-2026:33574). Because the fix is a library change, recompilation with the patched toolchain is required - simply updating the runtime host is insufficient. Where immediate rebuilding is not possible, reduce exposure by placing untrusted email-address parsing behind input size/length limits and per-request CPU or time budgets, rate-limiting endpoints that accept address strings, and rejecting oversized or malformed inputs before they reach net/mail; these controls blunt resource exhaustion but do not fully eliminate the pathological-input path and may reject some legitimate but unusual addresses.