Net Mail
Monthly
Denial of service in Go standard library net/mail package allows remote unauthenticated attackers to exhaust CPU and memory resources via maliciously crafted email addresses or dates. The vulnerability affects ParseAddress, ParseAddressList, and ParseDate functions in Go versions prior to 1.25.10 and 1.26.0-1.26.2. Confirmed actively exploited (CISA KEV status not indicated; exploitation probability 0.02% per EPSS). Vendor-released patches available in Go 1.25.10 and 1.26.3.
Denial of service in the Go standard library's net/mail package allows remote attackers to exhaust CPU or memory by submitting pathologically crafted email address strings that the consumePhrase routine parses inefficiently while handling RFC 5322 phrases. The flaw affects Go releases through 1.25.9 and the 1.26.0-1.26.2 series, is fixed in Go 1.26.3 and 1.25.10, and publicly available exploit code exists, though EPSS scores exploitation likelihood at only 0.01% and it is not on CISA KEV.
Denial of service in Go standard library net/mail package allows remote unauthenticated attackers to exhaust CPU and memory resources via maliciously crafted email addresses or dates. The vulnerability affects ParseAddress, ParseAddressList, and ParseDate functions in Go versions prior to 1.25.10 and 1.26.0-1.26.2. Confirmed actively exploited (CISA KEV status not indicated; exploitation probability 0.02% per EPSS). Vendor-released patches available in Go 1.25.10 and 1.26.3.
Denial of service in the Go standard library's net/mail package allows remote attackers to exhaust CPU or memory by submitting pathologically crafted email address strings that the consumePhrase routine parses inefficiently while handling RFC 5322 phrases. The flaw affects Go releases through 1.25.9 and the 1.26.0-1.26.2 series, is fixed in Go 1.26.3 and 1.25.10, and publicly available exploit code exists, though EPSS scores exploitation likelihood at only 0.01% and it is not on CISA KEV.