—
GO-2026-4986
Quadratic string concatentation in consumeComment in net/mail
Quick fix
GO-2026-4986 — stdlib: upgrade to the fixed version with the command below.
go get stdlib@v1.25.10Details
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
Are you affected?
Enter the version of the package you're using.