The vulnerability CVE-2026-42499 in the Go standard library net/mail package arises from inefficient algorithmic complexity (CWE-407) in the consumePhrase function used for parsing email addresses per RFC 5322. This inefficiency can be triggered by pathological inputs, leading to denial of service due to excessive resource consumption. The issue is documented with a CVSS v3.1 score of 7.5 (high severity), indicating network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. Red Hat advisories reference this CVE but do not explicitly state patch availability or remediation level. The affected version is Go 1.26.0-0. No known exploitation has been reported.

The impact of this vulnerability is a denial of service (DoS) condition caused by the net/mail package's consumePhrase function consuming excessive CPU resources when processing specially crafted email addresses. This can disrupt applications or services that rely on this parsing functionality, potentially leading to service unavailability. There is no reported impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Red Hat has published security advisories referencing CVE-2026-42499, so users of affected Red Hat products should monitor those advisories for updates and apply any provided fixes promptly. Until an official fix is available, consider implementing input validation or limiting exposure to untrusted email address inputs to reduce risk.