net/mail: ParseAddress: quadratic complexity in consumeComment (original) (raw)

Well-crafted inputs reaching ParseAddress, ParseAddressList,
and ParseDate were able to trigger excessive CPU exhaustion
and memory allocations.

This is CVE-2026-39820 and Go issue https://go.dev/issue/78566.

This was a PUBLIC track issue, tracked in http://b/500346169.