CVE-2026-39820

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Score

CVSS 3.1 7.5 High

Status

Modified - security@golang.org

Published

2026-05-07

Last modified

2026-10-26

Weaknesses

CWE-606, CWE-770

Affected products

• Netmail (Go Standard Library)
• Go (Golang)
• Acm (Redhat)
• Advanced Cluster Security (Redhat)
• Ansible Automation Platform (Redhat)
• Assisted Installer (Redhat)
• Ceph Storage (Redhat)
• Cert Manager (Redhat)
• Certifications (Redhat)
• Confidential Compute Attestation (Redhat)
• Container Native Virtualization (Redhat)
• Cryostat (Redhat)
• Devworkspace (Redhat)
• Edge Manager (Redhat)
• Enterprise Linux (Redhat)
• Enterprise Linux Ai (Redhat)
• Enterprise Linux Eus (Redhat)
• Ext Dns Optr (Redhat)
• External Secrets Operator (Redhat)
• Gatekeeper (Redhat)
• Hummingbird (Redhat)
• Lightspeed For Runtimes (Redhat)
• Logging (Redhat)
• Lvms (Redhat)
• Migration Toolkit Applications (Redhat)
• Multiarch Tuning Operator (Redhat)
• Multicluster Engine (Redhat)
• Multicluster Globalhub (Redhat)
• Network Observ Optr (Redhat)
• Ocp Tools (Redhat)
• Openshift (Redhat)
• Openshift Ai (Redhat)
• Openshift Api Data Protection (Redhat)
• Openshift Cluster Manager Cli (Redhat)
• Openshift Custom Metrics Autoscaler (Redhat)
• Openshift Data Foundation (Redhat)
• Openshift Devspaces (Redhat)
• Openshift Distributed Tracing (Redhat)
• Openshift File Integrity Operator (Redhat)
• Openshift Gitops (Redhat)
• Openshift Lightspeed (Redhat)
• Openshift Pipelines (Redhat)
• Openshift Power Monitoring (Redhat)
• Openshift Security Profiles Operator (Redhat)
• Openstack (Redhat)
• Quay (Redhat)
• Rhdh (Redhat)
• Rhel E4s (Redhat)
• Rhel Eus (Redhat)
• Rhel Tus (Redhat)
• Rhmt (Redhat)
• Satellite (Redhat)
• Serverless (Redhat)
• Service Interconnect (Redhat)
• Service Mesh (Redhat)
• Trusted Artifact Signer (Redhat)
• Windows Machine Config (Redhat)
• Workload Availability Far (Redhat)
• Workload Availability Mdr (Redhat)
• Workload Availability Nhc (Redhat)
• Workload Availability Nmo (Redhat)
• Workload Availability Sbr (Redhat)
• Workload Availability Snr (Redhat)
• Zero Trust Workload Identity Manager (Redhat)

References

• https://go.dev/issue/78566
• https://go.dev/cl/759940
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://pkg.go.dev/vuln/GO-2026-4986
• https://access.redhat.com/security/cve/CVE-2026-39820
• https://bugzilla.redhat.com/show_bug.cgi?id=2467820
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json
• https://access.redhat.com/errata/RHSA-2026:68334
• https://access.redhat.com/errata/RHSA-2026:50319
• https://access.redhat.com/errata/RHSA-2026:59830
• https://access.redhat.com/errata/RHSA-2026:65838
• https://access.redhat.com/errata/RHSA-2026:56852
• https://access.redhat.com/errata/RHSA-2026:60018
• https://access.redhat.com/errata/RHSA-2026:57482
• https://access.redhat.com/errata/RHSA-2026:54552
• https://access.redhat.com/errata/RHSA-2026:50336
• https://access.redhat.com/errata/RHSA-2026:57845
• https://access.redhat.com/errata/RHSA-2026:57914
• https://access.redhat.com/errata/RHSA-2026:57401
• https://access.redhat.com/errata/RHSA-2026:54883
• https://access.redhat.com/errata/RHSA-2026:49702
• https://access.redhat.com/errata/RHSA-2026:67517
• https://access.redhat.com/errata/RHSA-2026:65335
• https://access.redhat.com/errata/RHSA-2026:67974
• https://access.redhat.com/errata/RHSA-2026:66327
• https://access.redhat.com/errata/RHSA-2026:22120
• https://access.redhat.com/errata/RHSA-2026:63022
• https://access.redhat.com/errata/RHSA-2026:65534
• https://access.redhat.com/errata/RHSA-2026:65116
• https://access.redhat.com/errata/RHSA-2026:65895