Executive brief
A vulnerability in a common Go networking library could allow an attacker to crash applications that process DNS records. By sending a specially crafted, invalid DNS response (specifically SVCB or HTTPS records), an attacker can trigger a system 'panic' or crash. This results in a denial-of-service, potentially taking down web servers or other services that rely on this library to resolve internet addresses.
Technical details
A vulnerability exists in the golang.org/x/net/dns/dnsmessage package where parsing an invalid SVCB or HTTPS Resource Record (RR) can trigger a panic. The root cause is an integer overflow or bounds check failure that occurs when the size of a parameter value within the record exceeds the remaining message buffer during unpacking. This can be exploited by a remote attacker providing a malformed DNS response to an application using affected functions such as Message.Unpack or Parser.SVCBResource. The issue is fixed in version 0.56.0 of the golang.org/x/net library.
Affected products
- Google golang.org/x/net/dns/dnsmessage < 0.56.0
Timeline
- 2026-06-02: disclosed: Issue reported to Go project
- 2026-07-14: advisory: Go vulnerability report GO-2026-5942 published
- 2026-07-21: disclosed: CVE-2026-46600 published