Quadratic string concatentation in consumeComment in net/mail
Summary
| CVE | CVE-2026-39820 |
|---|---|
| State | PUBLISHED |
| Assigner | Go |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-05-07 20:16:43 UTC |
| Updated | 2026-07-10 12:16:44 UTC |
| Description | Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.000420000 probability, percentile 0.126170000 (date 2026-05-12)
Problem Types: CWE-770 | CWE-606 | CWE-407: Inefficient Algorithmic Complexity | CWE-606 Unchecked Input for Loop Condition
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | ADP | DECLARED | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | ADP | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:36797 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| pkg.go.dev/vuln/GO-2026-4986 | [email protected] | pkg.go.dev | Vendor Advisory |
| go.dev/issue/78566 | [email protected] | go.dev | Issue Tracking |
| access.redhat.com/errata/RHSA-2026:36754 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:34364 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:33123 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-39820 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36319 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| go.dev/cl/759940 | [email protected] | go.dev | Patch |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:33120 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| groups.google.com/g/golang-announce/c/qcCIEXso47M | [email protected] | groups.google.com | Issue Tracking, Mailing List |
| access.redhat.com/errata/RHSA-2026:36625 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:33142 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:33150 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:33574 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: thatnealpatel (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-05-07T20:01:27.800Z | Reported to Red Hat. |
| ADP | 2026-05-07T19:41:19.854Z | Made public. |
Solutions
ADP: RHSA-2026:34364: Logging Subsystem for Red Hat OpenShift 6.4
ADP: RHSA-2026:36625: Red Hat Advanced Cluster Security for Kubernetes 4.10
ADP: RHSA-2026:36319: Red Hat Advanced Cluster Security for Kubernetes 4.9
ADP: RHSA-2026:36754: Red Hat Developer Hub 1.10
ADP: RHSA-2026:33574: Red Hat Developer Hub 1.9
ADP: RHSA-2026:33123: Red Hat OpenShift Service Mesh 3.1
ADP: RHSA-2026:33142: Red Hat OpenShift Service Mesh 3.2
ADP: RHSA-2026:33150: Red Hat OpenShift Service Mesh 3.3
ADP: RHSA-2026:33120: Red Hat OpenShift Service Mesh 3
ADP: RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.