Resource exhaustion in Go programming language - CVE-2026-42499

Vulnerability identifier: #VU140615

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42499

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in net/mail consumePhrase when parsing an email address according to RFC 5322. A remote attacker can supply a pathological email address input to cause a denial of service.

Go programming language
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
butane (Red Hat package)
runc (Red Hat package)
containernetworking-plugins (Red Hat package)
skopeo (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
ignition (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
ose-gcp-gcr-image-credential-provider (Red Hat package)
microshift (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
grafana (Red Hat package)
osbuild-composer (Red Hat package)
Red Hat OpenShift Container Platform
Red Hat build of MicroShift

Install security update from vendor's website.

Go programming language - addressed in versions 1.25.10, 1.26.3
butane (Red Hat package) - addressed in versions 0.19.0-5.rhaos4.14.el8, 0.20.0-6.rhaos4.15.el8, 0.21.0-6.rhaos4.16.el8, 0.23.0-5.rhaos4.18.el8
runc (Red Hat package) - addressed in versions 1.2.9-5.rhaos4.16.el8, 1.2.9-5.rhaos4.16.el9, 1.2.9-7.rhaos4.18.el8, 1.2.9-7.rhaos4.18.el9
containernetworking-plugins (Red Hat package) - addressed in versions 1.4.0-7.rhaos4.12.el8, 1.4.0-7.rhaos4.14.el8, 1.4.0-7.rhaos4.15.el8, 1.4.0-10.rhaos4.16.el8, 1.4.0-10.rhaos4.18.el8
skopeo (Red Hat package) - addressed in versions 1.9.4-9.rhaos4.12.el8, 1.9.4-10.rhaos4.12.el9, 1.11.3-8.rhaos4.14.el8, 1.11.3-8.rhaos4.14.el9, 1.11.3-9.rhaos4.15.el8, 1.11.3-10.rhaos4.15.el9, 1.14.5-8.rhaos4.16.el8, 1.14.5-8.rhaos4.16.el9, 1.16.1-6.rhaos4.18.el8, 1.16.1-7.rhaos4.18.el9
cri-tools (Red Hat package) - addressed in versions 1.25.0-6.el9, 1.25.0-7.el8, 1.27.0-8.el8, 1.27.0-8.el9, 1.28.0-9.el8, 1.28.0-9.el9, 1.29.0-8.el8, 1.29.0-8.el9, 1.31.1-7.el8, 1.31.1-7.el9
cri-o (Red Hat package) - addressed in versions 1.25.5-34.rhaos4.12.git6120b13.el8, 1.27.8-19.rhaos4.14.gitcea2db1.el8, 1.27.8-19.rhaos4.14.gitcea2db1.el9, 1.28.11-14.rhaos4.15.gitf722b2f.el8, 1.28.11-14.rhaos4.15.gitf722b2f.el9, 1.29.13-12.rhaos4.16.git979a5e6.el8, 1.29.13-12.rhaos4.16.git979a5e6.el9, 1.31.13-11.rhaos4.18.git817a650.el9, 1.31.13-12.rhaos4.18.git249255c.el8
ignition (Red Hat package) - addressed in versions 2.18.0-8.rhaos4.16.el9, 2.18.0-11.rhaos4.18.el9, 2.21.0-3.el10_0.4
openshift (Red Hat package) - addressed in versions 4.12.0-202608131627.p2.g0e18cfc.assembly.stream.el8, 4.12.0-202608131627.p2.g0e18cfc.assembly.stream.el9, 4.14.0-202608131802.p2.g288be6b.assembly.stream.el8, 4.14.0-202608131802.p2.g288be6b.assembly.stream.el9, 4.15.0-202608131733.p2.g5cb2ef4.assembly.stream.el8, 4.15.0-202608131733.p2.g5cb2ef4.assembly.stream.el9, 4.16.0-202608111505.p2.g41c4e9b.assembly.stream.el8, 4.16.0-202608111505.p2.g41c4e9b.assembly.stream.el9, 4.18.0-202608132034.p2.g91c2408.assembly.stream.el8, 4.18.0-202608132034.p2.g91c2408.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.12.0-202608131627.p2.gd691257.assembly.stream.el8, 4.12.0-202608131627.p2.gd691257.assembly.stream.el9, 4.14.0-202608131802.p2.g44b3ac2.assembly.stream.el8, 4.14.0-202608131802.p2.g44b3ac2.assembly.stream.el9, 4.15.0-202608131733.p2.g8231637.assembly.stream.el8, 4.15.0-202608131733.p2.g8231637.assembly.stream.el9, 4.16.0-202608111505.p2.g6f88b58.assembly.stream.el8, 4.16.0-202608111505.p2.g6f88b58.assembly.stream.el9, 4.18.0-202608132034.p2.g6febe61.assembly.stream.el8, 4.18.0-202608132034.p2.g6febe61.assembly.stream.el9
Red Hat OpenShift Container Platform - addressed in versions 4.12.97, 4.14.72, 4.15.68, 4.16.69, 4.18.54
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.14.0-202608131802.p2.g9a7820e.assembly.stream.el8, 4.14.0-202608131802.p2.g9a7820e.assembly.stream.el9, 4.15.0-202608131733.p2.gfd77d92.assembly.stream.el8, 4.15.0-202608131733.p2.gfd77d92.assembly.stream.el9, 4.16.0-202608111505.p2.ga53e9de.assembly.stream.el8, 4.16.0-202608111505.p2.ga53e9de.assembly.stream.el9, 4.18.0-202608121933.p2.gc395190.assembly.stream.el8, 4.18.0-202608121933.p2.gc395190.assembly.stream.el9
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.15.0-202608131733.p2.g5638728.assembly.stream.el8, 4.15.0-202608131733.p2.g5638728.assembly.stream.el9, 4.16.0-202608111505.p2.ga3ebdc0.assembly.stream.el8, 4.16.0-202608111505.p2.ga3ebdc0.assembly.stream.el9, 4.18.0-202608121933.p2.g9795abd.assembly.stream.el8, 4.18.0-202608121933.p2.g9795abd.assembly.stream.el9
ose-gcp-gcr-image-credential-provider (Red Hat package) - addressed in versions 4.15.0-202608131733.p2.gfc50272.assembly.stream.el8, 4.15.0-202608131733.p2.gfc50272.assembly.stream.el9, 4.16.0-202608111505.p2.g26b43df.assembly.stream.el8, 4.16.0-202608111505.p2.g26b43df.assembly.stream.el9, 4.18.0-202608121933.p2.g6ea2356.assembly.stream.el8, 4.18.0-202608121933.p2.g6ea2356.assembly.stream.el9
Red Hat build of MicroShift - update to 4.18.54
microshift (Red Hat package) - update to 4.18.54-202608211117.p0.g8eb6c29.assembly.4.18.54.el9
kernel (Red Hat package) - update to 5.14.0-284.188.1.el9_2
kernel-rt (Red Hat package) - update to 5.14.0-284.188.1.rt14.473.el9_2
grafana (Red Hat package) - addressed in versions 9.2.10-33.el8_10, 10.2.6-28.el10_2.5
osbuild-composer (Red Hat package) - addressed in versions 76.1-9.el9_2, 101.3-4.el9_4.6, 132.2-12.el9_6

• https://pkg.go.dev/vuln/GO-2026-4977
• https://go.dev/cl/771520

• Multiple vulnerabilities in Go programming language
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14 packages
• Multiple vulnerabilities in Red Hat build of MicroShift 4.18 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15 packages
• Red Hat Enterprise Linux 8 update for grafana
• Red Hat Enterprise Linux 9 update for osbuild-composer
• Red Hat Enterprise Linux 9 update for osbuild-composer
• Red Hat Enterprise Linux 9 update for osbuild-composer
• Red Hat Enterprise Linux 10 update for grafana
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12 packages
• Red Hat Enterprise Linux 10 update for ignition