Vulnerability · Published May 7, 2026 · Assigned by Go
CVE-2026-39820Quadratic string concatentation in consumeComment in net/mail
High 7.5
In plain English
A high-severity security flaw in net/mail from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 43.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | delve | 1.25.2-1.module_el8.10.0+4074+24330916 | ALSA-2026:22112 |
| AlmaLinux:8 | go-toolset | 1.25.10-1.module_el8.10.0+4187+c45165c4 | ALSA-2026:22112 |
| AlmaLinux:9 | go-toolset | 1.26.3-1.el9_8 | ALSA-2026:22121 |
| AlmaLinux:8 | golang | 1.25.10-1.module_el8.10.0+4187+c45165c4 | ALSA-2026:22112 |
| AlmaLinux:9 | golang | 1.26.3-1.el9_8 | ALSA-2026:22121 |
| AlmaLinux:8 | golang-bin | 1.25.10-1.module_el8.10.0+4187+c45165c4 | ALSA-2026:22112 |
| AlmaLinux:9 | golang-bin | 1.26.3-1.el9_8 | ALSA-2026:22121 |
| AlmaLinux:8 | golang-docs | 1.25.10-1.module_el8.10.0+4187+c45165c4 | ALSA-2026:22112 |
| AlmaLinux:9 | golang-docs | 1.26.3-1.el9_8 | ALSA-2026:22121 |
| AlmaLinux:8 | golang-misc | 1.25.10-1.module_el8.10.0+4187+c45165c4 | ALSA-2026:22112 |
| AlmaLinux:9 | golang-misc | 1.26.3-1.el9_8 | ALSA-2026:22121 |
| AlmaLinux:8 | golang-race | 1.25.10-1.module_el8.10.0+4187+c45165c4 | ALSA-2026:22112 |
| AlmaLinux:9 | golang-race | 1.26.3-1.el9_8 | ALSA-2026:22121 |
| AlmaLinux:8 | golang-src | 1.25.10-1.module_el8.10.0+4187+c45165c4 | ALSA-2026:22112 |
| AlmaLinux:9 | golang-src | 1.26.3-1.el9_8 | ALSA-2026:22121 |
| AlmaLinux:8 | golang-tests | 1.25.10-1.module_el8.10.0+4187+c45165c4 | ALSA-2026:22112 |
| AlmaLinux:9 | golang-tests | 1.26.3-1.el9_8 | ALSA-2026:22121 |
| AlmaLinux:10 | grafana | 10.2.6-28.el10_2.5 | ALSA-2026:63022 |
| AlmaLinux:8 | grafana | 9.2.10-33.el8_10 | ALSA-2026:62407 |
| AlmaLinux:9 | grafana | 10.2.6-23.el9_8.3 | ALSA-2026:62406 |
| AlmaLinux:10 | grafana-selinux | 10.2.6-28.el10_2.5 | ALSA-2026:63022 |
| AlmaLinux:8 | grafana-selinux | 9.2.10-33.el8_10 | ALSA-2026:62407 |
| AlmaLinux:9 | grafana-selinux | 10.2.6-23.el9_8.3 | ALSA-2026:62406 |
| AlmaLinux:10 | opentelemetry-collector | 0.152.1-2.el10_2 | ALSA-2026:65116 |
| AlmaLinux:9 | opentelemetry-collector | 0.152.1-2.el9_8 | ALSA-2026:65117 |
| AlmaLinux:8 | osbuild-composer | 101.5-2.el8_10.alma.1 | ALSA-2026:66016 |
| AlmaLinux:9 | osbuild-composer | 165.1-4.el9_8.1.alma.1 | ALSA-2026:65153 |
| AlmaLinux:8 | osbuild-composer-core | 101.5-2.el8_10.alma.1 | ALSA-2026:66016 |
| AlmaLinux:9 | osbuild-composer-core | 165.1-4.el9_8.1.alma.1 | ALSA-2026:65153 |
| AlmaLinux:8 | osbuild-composer-worker | 101.5-2.el8_10.alma.1 | ALSA-2026:66016 |
| AlmaLinux:9 | osbuild-composer-worker | 165.1-4.el9_8.1.alma.1 | ALSA-2026:65153 |
| Alpine:v3.23 | go | 1.25.10-r0 | ALPINE-CVE-2026-39820 |
| Alpine:v3.24 | go | 1.26.3-r0 | ALPINE-CVE-2026-39820 |
| Alpine:v3.24 | rclone | 1.74.1-r0 | ALPINE-CVE-2026-39820 |
| Debian:12 | golang-1.19 | no fix listed | DEBIAN-CVE-2026-39820 |
| Debian:13 | golang-1.24 | no fix listed | DEBIAN-CVE-2026-39820 |
| Debian:14 | golang-1.26 | 1.26.3-1 | DEBIAN-CVE-2026-39820 |
| Go | stdlib | 1.25.10, 1.26.3 | GO-2026-4986 |
| Rocky Linux:8 | delve | 0:1.25.2-1.module+el8.10.0+40035+ee0a7047 | RLSA-2026:22112 |
| Rocky Linux:10 | golang | 0:1.26.3-4.el10_2 | RLSA-2026:22120 |
| Rocky Linux:8 | golang | 0:1.25.10-1.module+el8.10.0+40200+0fd0f175 | RLSA-2026:22112 |
| Rocky Linux:9 | golang | 0:1.26.3-1.el9_8 | RLSA-2026:22121 |
| Rocky Linux:10 | grafana | 0:10.2.6-28.el10_2.5 | RLSA-2026:63022 |
| Rocky Linux:8 | grafana | 0:9.2.10-33.el8_10 | RLSA-2026:62407 |
| Rocky Linux:9 | grafana | 0:10.2.6-23.el9_8.3 | RLSA-2026:62406 |
| Rocky Linux:10 | image-builder | 0:52.1-1.el10_2.2.rocky.0.1 | RLSA-2026:65534 |
| Rocky Linux:9 | image-builder | 0:52.1-1.el9_8.2 | RLSA-2026:65886 |
| Rocky Linux:10 | opentelemetry-collector | 0:0.152.1-2.el10_2 | RLSA-2026:65116 |
| Rocky Linux:9 | opentelemetry-collector | 0:0.152.1-2.el9_8 | RLSA-2026:65117 |
| Rocky Linux:10 | osbuild-composer | 0:165.1-3.el10_2.2.rocky.0.1 | RLSA-2026:65895 |
| Rocky Linux:8 | osbuild-composer | 0:101.5-2.el8_10.rocky.0.6 | RLSA-2026:66016 |
| Rocky Linux:9 | osbuild-composer | 0:165.1-4.el9_8.1.rocky.0.1 | RLSA-2026:65153 |
| Ubuntu:22.04:LTS | golang-1.17 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:22.04:LTS | golang-1.18 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:22.04:LTS | golang-1.20 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:22.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:24.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:22.04:LTS | golang-1.22 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:24.04:LTS | golang-1.22 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:22.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:24.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:25.10 | golang-1.23 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:26.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:22.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:24.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:25.10 | golang-1.24 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:26.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:22.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:24.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:25.10 | golang-1.25 | no fix listed | UBUNTU-CVE-2026-39820 |
| Ubuntu:26.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-39820 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | net/mail | 0 – before 1.25.101.26.0-0 – before 1.26.3 |
Weakness: CWE-606 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://go.dev/issue/78566
- https://go.dev/cl/759940
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M
- https://pkg.go.dev/vuln/GO-2026-4986
- https://access.redhat.com/security/cve/CVE-2026-39820 vdb-entry, x_refsource_REDHAT
- RHBZ#2467820 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:68334 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50319 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59830 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65838 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56852 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60018 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57482 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54552 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50336 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57845 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57914 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57401 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54883 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:49702 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:67517 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65335 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:67974 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66327 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22120 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:63022 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65534 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65116 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65895 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22112 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62407 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66016 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:68504 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:61253 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62754 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57649 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:68527 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62753 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:49712 vendor-advisory, x_refsource_REDHAT