The reported vulnerability stems from a quadratic string concatenation routine within the consumeComment function of Go’s net/mail package. When the library parses addresses or dates, malformed input can cause the concatenation to grow disproportionately, consuming excessive CPU cycles and allocating large amounts of memory. This flaw corresponds to CWE‑770, Excessive Memory Allocation, and also involves improper input validation (CWE‑606), allowing attackers to supply malformed data that triggers the overload. Attackers can craft such input to trigger an intentional denial of service.

Affected systems are applications and services that use the Go standard library’s net/mail functions ParseAddress, ParseAddressList, and ParseDate. Any Go runtime prior to the fix in GO-2026-4986 is susceptible. The specific release versions are not delineated in the CVE record, but the references indicate that the issue was addressed in a later Go release following the issue report.

The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not currently listed in the CISA KEV catalog. The nature of the flaw—excessive resource consumption during parsing—implies a high severity. The CVSS score of 7.5 indicates a high severity level. An attacker delivering a crafted email or HTTP payload to a vulnerable service could exhaust CPU or memory, potentially causing service downtime or crashing the application. The risk is amplified in environments that process untrusted inputs without additional validation or rate limiting.