Go standard library Net vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Go standard library Net: 3 record(s), with affected versions and fixes.

CVE-2026-46600 High · 7.5 CWE-125 Jul 21, 2026

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

CVE-2026-39836 High · 7.5 CWE-476 May 7, 2026

Panic in Dial and LookupPort when handling NUL byte on Windows in net

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

CVE-2026-33811 High · 7.5 CWE-415 May 7, 2026

Crash when handling long CNAME response in net

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.