Quadratic string concatentation in consumeComment in net/mail

高危 7.5CVE-2026-39820 · BIT-golang-2026-39820 · GO-2026-4986 · Published 07/05/2026 · updated 26/10/2026

要点

Package	Affected versions	Patched versions
stdlib Go	`≥ 1.26.0-0, < 1.26.3< 1.25.10`	`1.26.31.25.10`
go golang	`≥ 1.26.0, < 1.26.3< 1.25.10`	`1.26.31.25.10`

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

NVD description

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 1.26.0-0, < 1.26.3< 1.25.10

1.26.31.25.10

≥ 1.26.0, < 1.26.3< 1.25.10

1.26.31.25.10

Description

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

NVD description

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

stdlib 的其他漏洞

查看全部 →