CVE-2026-42499
Golang Go ≤ 1.25.10
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-42499 is a high-severity Creation of Immutable Text Using String Concatenation (CWE-1046) vulnerability in Golang Go. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-28432
Vulnerability Data
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability description directly describes DoS via exploitation of email address parsing (RFC 5322) with pathological inputs, mapping to application/system exploitation for endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation and sanitization of email address inputs to reject pathological RFC 5322 strings before consumePhrase parsing occurs.
Provides explicit denial-of-service protections that can throttle or drop inputs designed to trigger excessive resource consumption in address parsers.
Enables monitoring and anomaly detection for sudden spikes in CPU or parsing latency caused by crafted email addresses.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce correct immutable string handling and catch concatenation anti-patterns at code time.