ETK-2026-3896Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3896",
  "cve_id": null,
  "display_id": "ETK-2026-3896",
  "ghsa_id": "GHSA-f82v-42xw-72cj",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Out-of-bounds read in go-mail EML parser",
  "summary": "go-mail's EML parsing functions can panic when processing malformed, untrusted EML attachment metadata. An attacker who can cause an application to parse such EML input may disrupt the parsing goroutine or process.",
  "mitigation": "Upgrade github.com/wneessen/go-mail to version 0.8.2. Until upgraded, avoid parsing untrusted EML input or isolate EML parsing so a panic cannot interrupt the service.",
  "vendor": "go",
  "product": "go:github.com/wneessen/go-mail",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.4.2"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "0.8.2"
      ],
      "package_name": "github.com/wneessen/go-mail",
      "purl": "pkg:golang/github.com/wneessen/go-mail"
    }
  ],
  "cwes": [
    129
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 7.380176333333333,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-11-08T14:08:46+00:00",
      "days": -2.6698520646412036,
      "is_lower_bound": true,
      "measured_at": "2026-11-11T06:13:21.259651+00:00",
      "url": "https://github.com/wneessen/go-mail/security/advisories/GHSA-f82v-42xw-72cj"
    },
    "trigger_signal": {
      "at": "2026-11-08T14:08:46+00:00",
      "days": -2.6698520646412036,
      "is_lower_bound": true,
      "measured_at": "2026-11-11T06:13:21.259651+00:00",
      "url": "https://github.com/wneessen/go-mail/security/advisories/GHSA-f82v-42xw-72cj"
    }
  }
}