CVE-2026-39820

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770CWE-606

Affected software

No affected versions have been published.

Timeline

Published
May 7, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-398219.6The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xCVE-2026-398227.8On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of CVE-2026-398236.1CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL conteCVE-2026-398243.3NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeStriCVE-2026-398255.3ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director fuCVE-2026-398266.1If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespacCVE-2026-398276.5An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually craCVE-2026-398286.3When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded,CVE-2026-398297.5The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or CVE-2026-39833.5A security flaw has been discovered in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This affects an unknown partCVE-2026-398309.1A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blCVE-2026-398319.1The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User
CVE-2026-39820: High severity, CVSS 7.5 | Vulnix