fr Sign in

7.5 High

CVE-2026-39836 The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

Description

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

Affected products and versions

Product	Affected versions	Fixed in
net 1.26	1.26.0-0 → < 1.26.3	1.26.3
net 1.25	earliest → < 1.25.10	1.25.10

References

go.dev go.dev
groups.google.com groups.google.com
go.dev go.dev
pkg.go.dev pkg.go.dev

Timeline

Published May 7, 2026
Last modified May 8, 2026

The 4 CVEs of net →

CVE-2026-46600 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer 7.5 High CVE-2026-33811 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a… 7.5 High CVE-2024-24788 A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop 5.9 Medium

Track this CVE