An algorithmic complexity vulnerability in the Go standard library net/mail package allows unauthenticated attackers to cause denial of service via excessive CPU and memory consumption.

This issue is an inefficient algorithmic complexity flaw, classified under CWE-407, where specific input strings supplied to ParseAddress, ParseAddressList, and ParseDate lead to resource exhaustion. The attacker interaction vector is unauthenticated over the network with low complexity and no user interaction required.

A successful exploitation of this vulnerability can lead to severe service disruption, application crashes, and potential infrastructure instability due to resource exhaustion. Because parsing functions are often exposed to untrusted user input in web applications and API endpoints, the risk of widespread denial of service is significant. This risk is justified by a CVSS score of 7.5, reflecting high availability impact.

Immediate Action: Update the Go toolchain and affected applications to versions 1.25.10 or 1.26.3, or apply the appropriate upstream patches.

Proactive Monitoring: Monitor application resource utilization metrics, specifically CPU and memory spikes, associated with incoming requests that handle email address and date parsing.

Compensating Controls: Implement strict rate limiting and input size restrictions at the web application firewall or API gateway level to mitigate potential volumetric parsing abuse.

Public Exploit Available: false

Organizations utilizing the Go standard library for email or date parsing must treat this vulnerability with high priority. Apply the recommended Go runtime updates immediately to protect services from resource exhaustion attacks.