Is CVE-2026-39836 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39836 being exploited in the wild.

How severe is CVE-2026-39836?

High severity, with a CVSS score of 7.5, published 7 May 2026.

Which products and versions are affected?

stdlib (Go) SEMVER:introduced=0,fixed=1.25.10,introduced=1.26.0-0,fixed=1.26.3.

Is there a fix for CVE-2026-39836?

Yes. stdlib (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39836 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39836?

Check whether you run stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39836: Google Go Denial of Service in net Package on Windows

CVE-2026-39836 · Severity: high · CVSS 7.5 · Published 2026-05-07

A vulnerability in the Go programming language's networking library can cause applications running on Windows to crash. If an application uses certain networking functions to process user-supplied input, an attacker could send a specially crafted string containing a null character to trigger a system 'panic' or crash. This results in a denial-of-service, potentially disrupting business operations and service availability.

Technologies: stdlib (Go). Vendors: Go.

Quick answers

Is CVE-2026-39836 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39836 being exploited in the wild.
How severe is CVE-2026-39836?: High severity, with a CVSS score of 7.5, published 7 May 2026.
Which products and versions are affected?: stdlib (Go) SEMVER:introduced=0,fixed=1.25.10,introduced=1.26.0-0,fixed=1.26.3.
Is there a fix for CVE-2026-39836?: Yes. stdlib (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39836 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39836?: Check whether you run stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

stdlib (Go): upgrade to 1.26.3 or later
```
go get stdlib@v1.26.3
```

Technical details

A denial-of-service vulnerability exists in the Go standard library 'net' package on Windows platforms. The issue is caused by a NULL pointer dereference (CWE-476) or improper handling of NUL (0) bytes within the Dial and LookupPort functions (and related symbols like DialContext and Resolver.LookupPort). When these functions receive input containing a NUL byte, the runtime triggers a panic instead of returning an error. An unauthenticated remote attacker can exploit this by providing malformed input to network-facing Go applications, causing the process to terminate. The vulnerability is fixed in Go versions 1.25.10 and 1.26.3.

Affected products

Google Go < 1.25.10, >= 1.26.0 < 1.26.3

Identifiers

CVE-2026-39836
GO-2026-4971

Timeline

2026-04-29: disclosed: Issue opened on Go GitHub repository
2026-05-07: advisory: CVE published and Go security announcement released
2026-05-07: patched: Fixes released in Go 1.25.10 and 1.26.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.