A high-severity denial of service vulnerability in the Go net/mail package allows unauthenticated attackers to cause excessive CPU consumption, potentially crashing affected applications.

The vulnerability exists within the ParseAddress function, which utilizes inefficient string concatenation when processing domain-literal address components. This flaw allows an unauthenticated attacker to trigger a resource exhaustion condition by providing specifically crafted inputs that lead to excessive CPU utilization.

The exploitation of this vulnerability can result in significant service degradation or complete system unavailability, leading to downtime for applications relying on the affected Go library. Given the CVSS score of 7.5, this is classified as a High severity issue that, while not resulting in data theft, directly threatens the operational continuity of critical business services.

Immediate Action: Update the Go standard library to version 1.24.8 or 1.25.2, depending on your current release branch, to incorporate the necessary performance fixes.

Proactive Monitoring: Monitor server CPU utilization metrics and application logs for patterns indicating repeated or unusually long parsing requests targeting mail-handling components.

Compensating Controls: Implement strict request size limits or rate limiting at the application gateway or load balancer level to mitigate the impact of abnormally large input payloads.

Public Exploit Available: exploit_available (false)

This vulnerability presents a clear risk to service availability through resource exhaustion. It is recommended that development and operations teams prioritize the update of the Go environment to the patched versions immediately to eliminate the underlying algorithmic inefficiency and protect infrastructure from potential denial of service attacks.