The vulnerability in the Go standard library's net/mail package allows an attacker to craft specially formed email addresses that trigger a quadratic time complexity path in the consumePhrase function. When such inputs are parsed, the function performs repeated string concatenations that can consume excessive CPU resources, potentially exhausting system capacity and causing a denial of service. The flaw does not provide privilege escalation or code execution and is limited to disrupting service availability.

The Go standard library's net/mail package is the affected component. No specific Go versions are listed in the data, so all releases containing net/mail could be vulnerable until a patch is released.

The exploitability of this flaw requires the target to process an email address that includes the pathological input. Because the email address can be supplied remotely through network traffic, an attacker can trigger the DoS from outside the host. The EPSS score is not available, and the flaw is not listed in CISA's KEV catalog. The CVE data does not provide a severity rating, so the risk assessment is limited to the potential for resource exhaustion. The threat is significant in environments that handle a large volume of emails or allow unauthenticated input.