Go Standard Library Net Mail vulnerabilities

CVE-2026-39820 [HIGH] CWE-770 CVE-2026-39820: Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger exce Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

CVE-2026-42499 [HIGH] CWE-1046 CVE-2026-42499: Pathological inputs could cause DoS through consumePhrase when parsing an email address according to Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

CVE-2024-24784 [HIGH] CVE-2024-24784: The ParseAddressList function incorrectly handles comments (text within parentheses) within display The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

CVE-2025-61725 [HIGH] CVE-2025-61725: The ParseAddress function constructs domain-literal address components through repeated string conca The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.