Skip to content
Sign in
7.5 High

CVE-2024-24784 The ParseAddressList function incorrectly handles comments (text within parentheses) within display names

Description

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

Affected products and versions

Product Affected versions Fixed in
net/mail 1.22 1.22.0-0 → < 1.22.1 1.22.1
net/mail 1.21 earliest → < 1.21.8 1.21.8
net\/mail 1.22 1.22.0-0 → < 1.22.1 1.22.1
net\/mail 1.21 earliest → < 1.21.8 1.21.8

Other CVEs of net/mail

The 4 CVEs of net/mail →
CVE-2026-39820 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion… 7.5 High CVE-2026-42499 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322 7.5 High CVE-2025-61725 The ParseAddress function constructs domain-literal address components through repeated string concatenation 7.5 High
Track this CVE