7.5
High
CVE-2025-61725 The ParseAddress function constructs domain-literal address components through repeated string concatenation
Description
The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.
Affected products and versions
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of net/mail
The 4 CVEs of net/mail →
CVE-2026-39820
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion…
7.5
High
CVE-2026-42499
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322
7.5
High
CVE-2024-24784
The ParseAddressList function incorrectly handles comments (text within parentheses) within display names
7.5
High