Executive brief
A vulnerability in the Go programming language's networking library can cause applications running on Windows to crash. If an application uses certain networking functions to process user-supplied input, an attacker could send a specially crafted string containing a null character to trigger a system 'panic' or crash. This results in a denial-of-service, potentially disrupting business operations and service availability.
Technical details
A denial-of-service vulnerability exists in the Go standard library 'net' package on Windows platforms. The issue is caused by a NULL pointer dereference (CWE-476) or improper handling of NUL (0) bytes within the Dial and LookupPort functions (and related symbols like DialContext and Resolver.LookupPort). When these functions receive input containing a NUL byte, the runtime triggers a panic instead of returning an error. An unauthenticated remote attacker can exploit this by providing malformed input to network-facing Go applications, causing the process to terminate. The vulnerability is fixed in Go versions 1.25.10 and 1.26.3.
Affected products
- Google Go < 1.25.10, >= 1.26.0 < 1.26.3
Timeline
- 2026-04-29: disclosed: Issue opened on Go GitHub repository
- 2026-05-07: advisory: CVE published and Go security announcement released
- 2026-05-07: patched: Fixes released in Go 1.25.10 and 1.26.3