The reported vulnerability stems from a quadratic string concatenation routine within the consumeComment function of Go’s net/mail package. When the library parses addresses or dates, malformed input can cause the concatenation to grow disproportionately, consuming excessive CPU cycles and allocating large amounts of memory. Attackers can craft such input to trigger an intentional denial of service.

Affected systems are applications and services that use the Go standard library’s net/mail functions ParseAddress, ParseAddressList, and ParseDate. Any Go runtime prior to the fix in GO-2026-4986 is susceptible. The specific release versions are not delineated in the CVE record, but the references indicate that the issue was addressed in a later Go release following the issue report.

While no EPSS score is available and the vulnerability is not currently listed in the CISA KEV catalog, the nature of the flaw—excessive resource consumption during parsing—implies a high severity. An attacker delivering a crafted email or HTTP payload to a vulnerable service could exhaust CPU or memory, potentially causing service downtime or crashing the application. The risk is amplified in environments that process untrusted inputs without additional validation or rate limiting.