Skip to content
fr Sign in
7.5 High

CVE-2026-39820 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion…

Description

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Affected products and versions

Product Affected versions Fixed in
net/mail 1.26 1.26.0-0 → < 1.26.3 1.26.3
net/mail 1.25 earliest → < 1.25.10 1.25.10
Red Hat OpenShift Service Mesh 3.0 1782222607 earliest → < 1782222607 1782222607
Red Hat OpenShift Service Mesh 3.1 1782222451 earliest → < 1782222451 1782222451
Red Hat OpenShift Service Mesh 3.2 1782224541 earliest → < 1782224541 1782224541
Red Hat OpenShift Service Mesh 3.3 1782222038 earliest → < 1782222038 1782222038
Assisted Installer for Red Hat OpenShift Container Platform 2 Versions not published
cert-manager Operator for Red Hat OpenShift Versions not published
Confidential Compute Attestation Versions not published
Show the 129 other branches
Product Affected versions Fixed in
Cryostat 4 Versions not published
Custom Metric Autoscaler operator for Red Hat Openshift Versions not published
External Secrets Operator for Red Hat OpenShift Versions not published
File Integrity Operator Versions not published
Logging Subsystem for Red Hat OpenShift Versions not published
Logical Volume Manager Storage Versions not published
Migration Toolkit for Applications 8 Versions not published
Migration Toolkit for Containers Versions not published
Multiarch Tuning Operator Versions not published
Network Observability Operator Versions not published
OpenShift API for Data Protection Versions not published
OpenShift Developer Tools and Services Versions not published
OpenShift Lightspeed Versions not published
OpenShift Pipelines Versions not published
OpenShift Serverless Versions not published
OpenShift Service Mesh 2 Versions not published
OpenShift Service Mesh 3 Versions not published
Power monitoring for Red Hat OpenShift Versions not published
Red Hat Advanced Cluster Security 4 Versions not published
Red Hat Ceph Storage 5 Versions not published
Red Hat Ceph Storage 6 Versions not published
Red Hat Ceph Storage 9 Versions not published
Red Hat Certification Program for Red Hat Enterprise Linux 9 Versions not published
Red Hat Developer Hub Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat Hardened Images 1.26 earliest → < 1.26.4-2.hum1 1.26.4-2.hum1
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Cluster Manager CLI Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat OpenShift Dev Workspaces Operator Versions not published
Red Hat OpenShift distributed tracing 3 Versions not published
Red Hat OpenShift for Windows Containers Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat OpenStack Platform 18.0 Versions not published
Red Hat Quay 3 Versions not published
Red Hat Service Interconnect 1 Versions not published
Red Hat Service Interconnect 2 Versions not published
Red Hat Trusted Artifact Signer Versions not published
Security Profiles Operator Versions not published
Zero Trust Workload Identity Manager Versions not published
Zero Trust Workload Identity Manager - Tech Preview Versions not published
Red Hat OpenStack Platform 16.2 Versions not published
Red Hat OpenStack Platform 17.1 Versions not published
Gatekeeper 3 Versions not published
Multicluster Engine for Kubernetes Versions not published
Multicluster Global Hub Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Edge Manager 1 Versions not published
Red Hat Lightspeed for Runtimes Operator Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Developer Hub 1.9 1782767215 earliest → < 1782767215 1782767215
Logging Subsystem for Red Hat OpenShift 6.4 1782405469 earliest → < 1782405469 1782405469
Red Hat Advanced Cluster Security for Kubernetes 4.10 1783357140 earliest → < 1783357140 1783357140
Red Hat Advanced Cluster Security for Kubernetes 4.9 1783357116 earliest → < 1783357116 1783357116
Red Hat Developer Hub 1.10 1783447707 earliest → < 1783447707 1783447707
Red Hat Trusted Artifact Signer 1.4 4 earliest → < 4-1.4.2 4-1.4.2
Red Hat OpenShift Service Mesh 3 1782222607 earliest → < 1782222607 1782222607
Red Hat Quay 3.9 1784125838 earliest → < 1784125838 1784125838
Red Hat Quay 3.10 1783750447 earliest → < 1783750447 1783750447
Red Hat Quay 3.16 1783955846 earliest → < 1783955846 1783955846
Red Hat Advanced Cluster Security 4.9 1783357116 earliest → < 1783357116 1783357116
Red Hat Quay 3.1 1783750447 earliest → < 1783750447 1783750447
Red Hat Migration Toolkit 1.8 1783953372 earliest → < 1783953372 1783953372
Red Hat OpenShift AI 2.25 1783544461 earliest → < 1783544461 1783544461
Red Hat Quay 3.12 1784353904 earliest → < 1784353904 1784353904
Red Hat Quay 3.12 1783751865 earliest → < 1783751865 1783751865
Red Hat Migration Toolkit for Applications 8.2 1784211378 earliest → < 1784211378 1784211378
Red Hat Quay 3.15 1784351966 earliest → < 1784351966 1784351966
OpenShift API for Data Protection 1.6 1784058822 earliest → < 1784058822 1784058822
Logging for Red Hat OpenShift 6.4 1782405469 earliest → < 1782405469 1782405469
Logging Subsystem for Red Hat OpenShift 6.2 1784748010 earliest → < 1784748010 1784748010
Logging for Red Hat OpenShift 6.2 1784748010 earliest → < 1784748010 1784748010
Red Hat Migration Toolkit for Applications 8.1 1785171639 earliest → < 1785171639 1785171639
Red Hat OpenShift distributed tracing 3.10.1 1785704547 earliest → < 1785704547 1785704547
Logging Subsystem for Red Hat OpenShift 6.0 1785419067 earliest → < 1785419067 1785419067
OpenShift API for Data Protection 1.3 1785177357 earliest → < 1785177357 1785177357
Logging for Red Hat OpenShift 6.0 1785419067 earliest → < 1785419067 1785419067
Red Hat OpenShift distributed tracing 3.10.2 1785704547 earliest → < 1785704547 1785704547
Fence Agents Remediation Operator Versions not published
Machine Deletion Remediation Operator Versions not published
Node HealthCheck Operator Versions not published
Node Maintenance Operator Versions not published
Self Node Remediation Operator Versions not published
Storage-Based Remediation Versions not published
Red Hat OpenShift Workload Availability 0.12 1785202723 earliest → < 1785202723 1785202723
Red Hat OpenShift Workload Availability 0.7 1785203508 earliest → < 1785203508 1785203508
Red Hat OpenShift Workload Availability 5.7 1785202847 earliest → < 1785202847 1785202847
Cert Manager support for Red Hat OpenShift release 1.19 1786613805 earliest → < 1786613805 1786613805
Red Hat OpenShift Workload Availability 0.13 1785203036 earliest → < 1785203036 1785203036
Red Hat OpenShift Workload Availability 0.3 1785203474 earliest → < 1785203474 1785203474
Red Hat OpenShift Workload Availability 0.8 1785203079 earliest → < 1785203079 1785203079
Red Hat OpenShift distributed tracing 3.10.0 1785704547 earliest → < 1785704547 1785704547
Red Hat Migration Toolkit for Containers 1.8 1783953372 earliest → < 1783953372 1783953372
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.6 Extended Update Support Versions not published
Red Hat OpenShift Container Platform 4.16 1786788280 earliest → < 1786788280 1786788280
Red Hat OpenShift Container Platform 4.18 1786754308 earliest → < 1786754308 1786754308
Red Hat OpenShift Container Platform 4.19 1786489910 earliest → < 1786489910 1786489910
Logging Subsystem for Red Hat OpenShift 6.5 1786645248 earliest → < 1786645248 1786645248
multicluster engine for Kubernetes 2.11 1786912006 earliest → < 1786912006 1786912006
OpenShift API for Data Protection 1.4 1786946116 earliest → < 1786946116 1786946116
Red Hat OpenShift AI 3.4 1787562200 earliest → < 1787562200 1787562200
Red Hat OpenShift Container Platform 4.14 1787002807 earliest → < 1787002807 1787002807
Red Hat OpenShift Container Platform 4.20 1786494900 earliest → < 1786494900 1786494900
Red Hat OpenShift Container Platform 4.21 1786573075 earliest → < 1786573075 1786573075
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Versions not published
Red Hat OpenShift Dev Spaces 3.30 1787756799 earliest → < 1787756799 1787756799
Red Hat OpenShift Container Platform 4.12 1786752886 earliest → < 1786752886 1786752886
Red Hat OpenShift Container Platform 4.17 1787549445 earliest → < 1787549445 1787549445
Red Hat OpenShift Container Platform 4.2 1786494900 earliest → < 1786494900 1786494900
Logging for Red Hat OpenShift 6 1785419067 earliest → < 1785419067 1785419067
ExternalDNS Operator Versions not published
OpenShift API for Data Protection 1.5 1788860461 earliest → < 1788860461 1788860461
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Versions not published
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Versions not published
Red Hat OpenShift Container Platform 4.13 Versions not published
RHEM 1.1 for RHEL 10 Versions not published
RHEM 1.1 for RHEL 9 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of net/mail

The 4 CVEs of net/mail →
CVE-2026-42499 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322 7.5 High CVE-2025-61725 The ParseAddress function constructs domain-literal address components through repeated string concatenation 7.5 High CVE-2024-24784 The ParseAddressList function incorrectly handles comments (text within parentheses) within display names 7.5 High
Track this CVE