CVE-2026-39836 - Vulnerability Details - OpenCVE

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Go Standard Library	Net

No data.

No data.

References

Link	Providers
https://go.dev/cl/775320
https://go.dev/issue/79006
https://groups.google.com/g/golang-announce/c/qcCIEXso47M
https://pkg.go.dev/vuln/GO-2026-4971

History

Mon, 11 May 2026 17:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Go Standard Library Go Standard Library net
Vendors & Products		Go Standard Library Go Standard Library net

Sat, 09 May 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Sat, 09 May 2026 00:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20

Fri, 08 May 2026 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 07 May 2026 21:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Thu, 07 May 2026 20:00:00 +0000

Type	Values Removed	Values Added
Description		The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
Title		Panic in Dial and LookupPort when handling NUL byte on Windows in net
References		https://go.dev/cl/775320 https://go.dev/issue/79006 https://groups.google.com/g/golang-announce/c/qcCIEXso47M https://pkg.go.dev/vuln/GO-2026-4971

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2026-05-07T19:41:18.300Z

Updated: 2026-05-08T21:30:15.127Z

Reserved: 2026-04-07T18:13:03.529Z

Link: CVE-2026-39836

Vulnrichment

Updated: 2026-05-08T16:44:57.022Z

NVD

Status : Undergoing Analysis

Published: 2026-05-07T20:16:43.593

Modified: 2026-05-08T22:16:29.723

Link: CVE-2026-39836

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39836", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-04-07T18:13:03.529Z", "datePublished": "2026-05-07T19:41:18.300Z", "dateUpdated": "2026-05-08T21:30:15.127Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-05-07T19:41:18.300Z"}, "title": "Panic in Dial and LookupPort when handling NUL byte on Windows in net", "descriptions": [{"lang": "en", "value": "The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)."}], "affected": [{"vendor": "Go standard library", "product": "net", "collectionURL": "https://pkg.go.dev", "packageName": "net", "versions": [{"version": "0", "lessThan": "1.25.10", "status": "affected", "versionType": "semver"}, {"version": "1.26.0-0", "lessThan": "1.26.3", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "Resolver.lookupPort"}, {"name": "Resolver.lookupAddr"}, {"name": "Resolver.lookupTXT"}, {"name": "Resolver.lookupNS"}, {"name": "Resolver.lookupMX"}, {"name": "Resolver.lookupSRV"}, {"name": "Dial"}, {"name": "DialTimeout"}, {"name": "Dialer.Dial"}, {"name": "Dialer.DialContext"}, {"name": "Listen"}, {"name": "ListenConfig.Listen"}, {"name": "ListenConfig.ListenPacket"}, {"name": "ListenPacket"}, {"name": "LookupAddr"}, {"name": "LookupCNAME"}, {"name": "LookupHost"}, {"name": "LookupIP"}, {"name": "LookupMX"}, {"name": "LookupNS"}, {"name": "LookupPort"}, {"name": "LookupSRV"}, {"name": "LookupTXT"}, {"name": "ResolveIPAddr"}, {"name": "ResolveTCPAddr"}, {"name": "ResolveUDPAddr"}, {"name": "Resolver.LookupAddr"}, {"name": "Resolver.LookupCNAME"}, {"name": "Resolver.LookupHost"}, {"name": "Resolver.LookupIP"}, {"name": "Resolver.LookupIPAddr"}, {"name": "Resolver.LookupMX"}, {"name": "Resolver.LookupNS"}, {"name": "Resolver.LookupNetIP"}, {"name": "Resolver.LookupPort"}, {"name": "Resolver.LookupSRV"}, {"name": "Resolver.LookupTXT"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-248: Uncaught Exception"}]}], "references": [{"url": "https://go.dev/issue/79006"}, {"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"}, {"url": "https://go.dev/cl/775320"}, {"url": "https://pkg.go.dev/vuln/GO-2026-4971"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-08T16:36:25.079035Z", "id": "CVE-2026-39836", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T21:30:15.127Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-39836", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T16:36:25.079035Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T16:44:57.022Z"}}], "cna": {"title": "Panic in Dial and LookupPort when handling NUL byte on Windows in net", "affected": [{"vendor": "Go standard library", "product": "net", "versions": [{"status": "affected", "version": "0", "lessThan": "1.25.10", "versionType": "semver"}, {"status": "affected", "version": "1.26.0-0", "lessThan": "1.26.3", "versionType": "semver"}], "packageName": "net", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "Resolver.lookupPort"}, {"name": "Resolver.lookupAddr"}, {"name": "Resolver.lookupTXT"}, {"name": "Resolver.lookupNS"}, {"name": "Resolver.lookupMX"}, {"name": "Resolver.lookupSRV"}, {"name": "Dial"}, {"name": "DialTimeout"}, {"name": "Dialer.Dial"}, {"name": "Dialer.DialContext"}, {"name": "Listen"}, {"name": "ListenConfig.Listen"}, {"name": "ListenConfig.ListenPacket"}, {"name": "ListenPacket"}, {"name": "LookupAddr"}, {"name": "LookupCNAME"}, {"name": "LookupHost"}, {"name": "LookupIP"}, {"name": "LookupMX"}, {"name": "LookupNS"}, {"name": "LookupPort"}, {"name": "LookupSRV"}, {"name": "LookupTXT"}, {"name": "ResolveIPAddr"}, {"name": "ResolveTCPAddr"}, {"name": "ResolveUDPAddr"}, {"name": "Resolver.LookupAddr"}, {"name": "Resolver.LookupCNAME"}, {"name": "Resolver.LookupHost"}, {"name": "Resolver.LookupIP"}, {"name": "Resolver.LookupIPAddr"}, {"name": "Resolver.LookupMX"}, {"name": "Resolver.LookupNS"}, {"name": "Resolver.LookupNetIP"}, {"name": "Resolver.LookupPort"}, {"name": "Resolver.LookupSRV"}, {"name": "Resolver.LookupTXT"}]}], "references": [{"url": "https://go.dev/issue/79006"}, {"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"}, {"url": "https://go.dev/cl/775320"}, {"url": "https://pkg.go.dev/vuln/GO-2026-4971"}], "descriptions": [{"lang": "en", "value": "The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-248: Uncaught Exception"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-05-07T19:41:18.300Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39836", "state": "PUBLISHED", "dateUpdated": "2026-05-08T21:30:15.127Z", "dateReserved": "2026-04-07T18:13:03.529Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-05-07T19:41:18.300Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}