Go net/mail Package Quadratic String Concatenation Vulnerability in Email Parsing

A denial-of-service vulnerability has been identified in the net/mail package of Go. Pathological inputs can lead to excessive CPU consumption and memory allocation by causing quadratic string concatenation in the consumePhrase function. This issue arises when the function parses email addresses, as specified by RFC 5322. The vulnerability affects Go versions prior to 1.25.10, as well as versions from 1.26.0 up to but not including 1.26.3.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing excessive CPU usage and memory consumption.

Remediation

Users can upgrade to Go versions 1.26.3 or 1.25.10, both of which include the necessary fix. Instructions for downloading these versions are available on the Go website.