This vulnerability involves inefficient algorithmic complexity in the Go standard library's net/mail package. Specifically, the functions ParseAddress, ParseAddressList, and ParseDate can be induced by specially crafted inputs to consume excessive CPU resources and memory, potentially leading to denial of service conditions. The affected versions include 0 through 1.26.0-0. There is no CVSS score or vendor advisory indicating a patch or mitigation status at this time.

The impact is primarily resource exhaustion, where an attacker could cause excessive CPU and memory consumption by supplying crafted inputs to the vulnerable functions. This could degrade service performance or cause denial of service in applications using the affected Go net/mail package versions. There are no known exploits in the wild reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure to untrusted inputs processed by the affected functions or implement input validation and resource usage monitoring as temporary mitigations.