CVE-2026-39836
CVE-2026-39836 · Panic in Dial and LookupPort when handling NUL byte on Windows in net
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
CVSS 7.5 · High · EPSS 0.6% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
net
- Versions
- ≥ 0, < 1.25.10: Affected (semver)
- ≥ 1.26.0-0, < 1.26.3: Affected (semver)
Update to 1.25.10; Update to 1.26.3
golang-1.25 Ubuntu:22.04:LTS
- Versions
- 1.25.14-1~ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.25 Ubuntu:24.04:LTS
- Versions
- 1.25.14-1~ubuntu0.24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published