CVE-2026-39820 is an inefficient algorithmic complexity vulnerability (CWE-407) in the Go standard library's net/mail package. Specifically, the ParseAddress, ParseAddressList, and ParseDate functions can be induced by crafted inputs to consume excessive CPU and memory resources. This vulnerability can lead to denial of service conditions due to resource exhaustion. The affected version is Go 1.26.0-0. Red Hat has issued advisories acknowledging this vulnerability and providing updates for their products that include the affected components. However, the vendor remediation level is not specified, and no direct patch link is provided in the data. No known active exploitation has been reported.

The vulnerability allows an attacker to cause excessive CPU usage and memory allocation by providing maliciously crafted inputs to specific parsing functions in the Go net/mail package. This can result in denial of service conditions, impacting availability of applications using the affected library version. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been observed.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Red Hat has published security advisories referencing this CVE, which should be monitored for updates and patches. Until an official fix is available, consider applying any recommended workarounds from the vendor advisories or limiting exposure to untrusted inputs processed by the affected functions.