This vulnerability (CVE-2026-39820) in the Go standard library net/mail package involves inefficient algorithmic complexity (CWE-407) and unchecked input for loop condition (CWE-606). When applications call ParseAddress, ParseAddressList, or ParseDate with specially crafted inputs, it can trigger excessive CPU exhaustion and memory allocations, resulting in denial of service. The issue is confirmed by Red Hat and scored with a CVSS v3.1 base score of 7.5 (high severity) with no confidentiality or integrity impact but high availability impact. Red Hat advisories indicate no current patch or fix meeting their criteria is available, and mitigation options are limited. The vulnerability affects specific Go versions including 1.26.0-0 and 0 as stated.

The vulnerability allows an attacker to cause denial of service by exhausting CPU and memory resources in applications using the affected Go net/mail functions. This can lead to service unavailability for applications processing untrusted email inputs. There is no impact on confidentiality or integrity, only availability is affected.

According to the Red Hat advisory, no official fix or patch currently meets their criteria for deployment and stability. Users should monitor vendor advisories for updates and consider upgrading to supported versions once fixes become available. In the meantime, mitigating exposure by limiting or validating untrusted inputs to the affected functions may reduce risk, although no specific mitigation is officially recommended.