Vulnerability Report: GO-2026-5942

Affected Packages

• Path
  Go Versions
  Symbols
• net
  from go1.26.0-0 before go1.26.6, from go1.27.0-0 before go1.27.0-rc.3
  • LookupCNAME
  • Resolver.LookupCNAME
• golang.org/x/net/dns/dnsmessage
  before v0.56.0
  9 affected symbols

  • Message.Unpack
  • Parser.Additional
  • Parser.AllAdditionals
  • Parser.AllAnswers
  • Parser.AllAuthorities
  • Parser.Answer
  • Parser.Authority
  • Parser.HTTPSResource
  • Parser.SVCBResource

Aliases

• CVE-2026-46600

References

• https://go.dev/cl/786345
• https://go.dev/issue/79795
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://vuln.go.dev/ID/GO-2026-5942.json

Credits

• Mundur (https://github.com/M0nd0R)

Feedback