A denial of service vulnerability in the Go standard library net/mail package affects Go versions prior to 1.25.10 and 1.26.3, creating a risk of application crashes through crafted email inputs.

This is an inefficient algorithmic complexity flaw classified as CWE-407, triggered within the consumePhrase function during RFC 5322 email address parsing by unauthenticated attackers.

A successful exploit can lead to significant service degradation or total application downtime as CPU resources become exhausted while parsing malformed email addresses. With a CVSS score of 7.5, this high severity flaw requires prompt attention to maintain system availability and prevent potential service outages.

Immediate Action: Update the Go standard library to version 1.25.10, 1.26.3, or later where the parsing logic is corrected.

Proactive Monitoring: Monitor application resource utilization, particularly CPU spikes and goroutine counts associated with incoming email parsing requests.

Compensating Controls: Implement input validation limits and request timeouts at the application boundary to drop excessively long or malformed email header inputs before they reach the mail parser.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing affected versions of Go must prioritize applying the official runtime updates immediately. Promptly deploying the patched Go versions eliminates the algorithmic complexity risk and restores safe email parsing behavior across all dependent applications.