Cyber Resilience

CVE-2026-42499

Golang Go ≤ 1.25.10

Published
07 May 2026
Modified
26 August 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0080 54th percentile
Risk Priority 59 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-42499 is a high-severity Creation of Immutable Text Using String Concatenation (CWE-1046) vulnerability in Golang Go. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 46% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

CWE(s)
NVD-CWE-noinfoCWE-1046

Related Threats

CVEs Like This One

CVE-2026-27144Same product: Golang Go
CVE-2023-24536Same product: Golang Go
CVE-2025-61729Same product: Golang Go
CVE-2026-32281Same product: Golang Go
CVE-2026-32280Same product: Golang Go
CVE-2025-4674Same product: Golang Go
CVE-2025-61732Same product: Golang Go
CVE-2023-24532Same product: Golang Go
CVE-2023-39322Same product: Golang Go
CVE-2025-61724Same product: Golang Go

Affected Assets

golang
go
≤ 1.25.10 · 1.26.0 — 1.26.3

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly enforce correct immutable string handling and catch concatenation anti-patterns at code time.

References