CVE-2026-46600 - Vulnerability Details - OpenCVE

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Golang	Net

No data.

No data.

References

Link	Providers
https://go.dev/cl/786345
https://go.dev/issue/79795
https://pkg.go.dev/vuln/GO-2026-5942

History

Thu, 23 Jul 2026 21:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Golang Golang net
Weaknesses		CWE-125
Vendors & Products		Golang Golang net
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 21 Jul 2026 19:45:00 +0000

Type	Values Removed	Values Added
Description		Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
Title		Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
References		https://go.dev/cl/786345 https://go.dev/issue/79795 https://pkg.go.dev/vuln/GO-2026-5942

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2026-07-21T19:18:59.755Z

Updated: 2026-07-23T15:00:35.473Z

Reserved: 2026-05-15T17:35:00.814Z

Link: CVE-2026-46600

Vulnrichment

Updated: 2026-07-23T15:00:16.150Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46600", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-05-15T17:35:00.814Z", "datePublished": "2026-07-21T19:18:59.755Z", "dateUpdated": "2026-07-23T15:00:35.473Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-07-21T19:18:59.755Z"}, "title": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage", "descriptions": [{"lang": "en", "value": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer."}], "affected": [{"vendor": "golang.org/x/net", "product": "golang.org/x/net/dns/dnsmessage", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/net/dns/dnsmessage", "versions": [{"version": "0", "lessThan": "0.56.0", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "unpackSVCBResource"}, {"name": "Message.Unpack"}, {"name": "Parser.Additional"}, {"name": "Parser.AllAdditionals"}, {"name": "Parser.AllAnswers"}, {"name": "Parser.AllAuthorities"}, {"name": "Parser.Answer"}, {"name": "Parser.Authority"}, {"name": "Parser.HTTPSResource"}, {"name": "Parser.SVCBResource"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125: Out-of-bounds Read"}]}], "references": [{"url": "https://go.dev/cl/786345"}, {"url": "https://go.dev/issue/79795"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5942"}], "credits": [{"lang": "en", "value": "Mundur (https://github.com/M0nd0R)"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T15:00:27.171241Z", "id": "CVE-2026-46600", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T15:00:35.473Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-46600", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T15:00:27.171241Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T15:00:16.150Z"}}], "cna": {"title": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage", "credits": [{"lang": "en", "value": "Mundur (https://github.com/M0nd0R)"}], "affected": [{"vendor": "golang.org/x/net", "product": "golang.org/x/net/dns/dnsmessage", "versions": [{"status": "affected", "version": "0", "lessThan": "0.56.0", "versionType": "semver"}], "packageName": "golang.org/x/net/dns/dnsmessage", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "unpackSVCBResource"}, {"name": "Message.Unpack"}, {"name": "Parser.Additional"}, {"name": "Parser.AllAdditionals"}, {"name": "Parser.AllAnswers"}, {"name": "Parser.AllAuthorities"}, {"name": "Parser.Answer"}, {"name": "Parser.Authority"}, {"name": "Parser.HTTPSResource"}, {"name": "Parser.SVCBResource"}]}], "references": [{"url": "https://go.dev/cl/786345"}, {"url": "https://go.dev/issue/79795"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5942"}], "descriptions": [{"lang": "en", "value": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-07-21T19:18:59.755Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46600", "state": "PUBLISHED", "dateUpdated": "2026-07-23T15:00:35.473Z", "dateReserved": "2026-05-15T17:35:00.814Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-07-21T19:18:59.755Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}