The vulnerability in the Go standard library's net/mail package allows an attacker to craft specially formed email addresses that trigger a quadratic time complexity path in the consumePhrase function. When such inputs are parsed, the function performs repeated string concatenations that can consume excessive CPU resources, potentially exhausting system capacity and causing a denial of service. The flaw does not provide privilege escalation or code execution and is limited to disrupting service availability.

The Go standard library's net/mail package is the affected component. No specific Go versions are listed in the data, so all releases containing net/mail could be vulnerable until a patch is released.

The exploitability of this flaw requires the target to process an email address that includes the pathological input. Based on the description, it is inferred that the email address can be supplied remotely through network traffic, allowing an attacker to trigger the DoS from outside the host. The EPSS score is < 1%, and the flaw is not listed in CISA's KEV catalog. The CVSS score of 7.5 indicates a high severity, reinforcing the risk of significant resource exhaustion. The threat is significant in environments that handle a large volume of emails or allow unauthenticated input.