CVE-2026-42499 is a denial of service vulnerability in the Go standard library's net/mail package. The consumePhrase function, used to parse email addresses according to RFC 5322, can be triggered by specially crafted pathological inputs that cause quadratic string concatenation. This results in excessive resource consumption and potential application denial of service. The vulnerability affects Go versions referenced in Red Hat Hardened Images. Red Hat has published advisories acknowledging the issue but currently has no fix or effective mitigation available that meets their standards for ease of use, deployment, or stability.

A remote attacker can exploit this vulnerability by supplying malformed email addresses to applications using the affected net/mail package. This leads to excessive CPU and memory usage due to inefficient parsing, causing denial of service conditions. There is no impact on confidentiality or integrity, only availability is affected. No known exploits are reported in the wild at this time.

Red Hat currently states that no mitigation is available or meets their criteria for deployment and stability. Users should monitor Red Hat advisories for future updates. Until a fix is released, consider limiting exposure of affected components to untrusted inputs or applying application-level input validation to reduce risk.