VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 5, 2024· Updated Apr 15, 2026

CVE-2024-24784

CVE-2024-24784

Description

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Go's net/mail ParseAddressList mishandles parentheses in display names, creating a parser misalignment that can lead to inconsistent trust decisions.

Vulnerability

Overview

CVE-2024-24784 concerns a flaw in Go's net/mail package, specifically in the ParseAddressList function. The function incorrectly handles comments—text enclosed within parentheses—that appear inside email display names. This behavior diverges from RFC 5322, which governs email address parsing [3].

Attack

Vector

An attacker can craft an email address such as Hello (comment) there <hello@example.com>. While conforming parsers would correctly extract the display name as Hello there, Go's parser produces Hello (comment) there [3]. This misalignment is exploitable when different systems (e.g., a mail server and a security scanner) rely on different parsers to make trust decisions based on the display name [1][4].

Impact

The core risk is that security decisions—such as spam classification, sender verification, or display-name-based allowlisting—can be inconsistent across applications. For example, one program might treat the display name as Hello there while another treats it as Hello (comment) there, potentially allowing an attacker to bypass filters or impersonate a trusted sender [3].

Mitigation

Go addressed the issue in releases 1.22.1 and 1.21.8 by reverting a previous change that allowed special characters in the atom syntax and implementing proper handling of comments in display names [1][2][3]. All users are urged to upgrade to these patched versions. No workaround is available.

References
  1. security - 5 CVEs fixed in Go 1.22.1 and Go 1.21.8, 1 CVE fixed in google.golang.org/protobuf
  2. [security] Go 1.22.1 and Go 1.21.8 are released
  3. net/mail: comments in display names are incorrectly handled
  4. GO-2024-2609 - Go Packages

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1398

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.