CVE-2026-42499
HIGHDescription
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Affected Products
| Vendor | Product |
|---|---|
| golang | go |
| golang | go |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2026-42499? +
How severe is CVE-2026-42499? +
What products are affected by CVE-2026-42499? +
How do I check if I'm vulnerable to CVE-2026-42499? +
Related Vulnerabilities
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses …
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration …
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE …
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database …