CVE-2026-42499

HighCVSS 7.5/10Last modified Sep 18, 2026

Description

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1046

Affected software

No affected versions have been published.

Timeline

Published
May 7, 2026
Last modified
Sep 18, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-42502.5A vulnerability was found in Albert Sağlık Hizmetleri ve Ticaret Albert Health up to 1.7.3 on Android. Affected is an unknown function of thCVE-2026-425005.3Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.CVE-2026-425017.5A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This CVE-2026-425026.1Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacCVE-2026-425038.8gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value wiCVE-2026-425047.5Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.CVE-2026-425055.3Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key idenCVE-2026-425066.1Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacCVE-2026-425075.3When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to CVE-2026-425089.1Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' CVE-2026-425096.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects ApaCVE-2026-42512.5A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of t
CVE-2026-42499: High severity, CVSS 7.5 | Vulnix