VDB
KO

GO-2026-4986

Quadratic string concatentation in consumeComment in net/mail

Details

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / stdlib
Introduced in: 0 Fixed in: 1.25.10
Fix go get stdlib@v1.25.10

References