Go Standard Library Net/Mail vulnerabilities

4 vulnerabilities

Known vulnerabilities in Go Standard Library Net/Mail, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.5CVE-2025-61725chainguardage+2325
EPSS score
0.65%
The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.7.5CVE-2024-24784chainguardactions-runner-controller+561
EPSS score
1.05%
The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.7.5CVE-2026-42499chainguardaactl+3320
EPSS score
0.80%
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.7.5CVE-2026-39820chainguardaactl+3324
EPSS score
0.78%
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.