Is CVE-2026-46600 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46600 being exploited in the wild.

How severe is CVE-2026-46600?

Informational severity, published 21 July 2026.

Which products and versions are affected?

golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.56.0; stdlib (Go) SEMVER:introduced=1.26.0-0,fixed=1.26.6,introduced=1.27.0-0,fixed=1.27.0-rc.3; Google Dnsmessage < 0.56.0.

Is there a fix for CVE-2026-46600?

Yes. golang.org/x/net (Go): upgrade to 0.56.0 or later; stdlib (Go): upgrade to 1.27.0-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46600 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46600?

Check whether you run golang.org/x/net (Go), stdlib (Go) or Google Dnsmessage at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46600: Google Go x/net denial of service in dnsmessage parsing

Q: Is there a fix for CVE-2026-46600?

Yes. golang.org/x/net (Go): upgrade to 0.56.0 or later; stdlib (Go): upgrade to 1.27.0-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46600 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-46600?

Check whether you run golang.org/x/net (Go), stdlib (Go) or Google Dnsmessage at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46600 · Severity: info · Published 2026-07-21

A vulnerability in a common Go networking library could allow an attacker to crash applications that process DNS records. By sending a specially crafted, invalid DNS response (specifically SVCB or HTTPS records), an attacker can trigger a system 'panic' or crash. This results in a denial-of-service, potentially taking down web servers or other services that rely on this library to resolve internet addresses.

Technologies: golang.org/x/net (Go), stdlib (Go). Vendors: Go, Google.

Quick answers

Is CVE-2026-46600 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46600 being exploited in the wild.
How severe is CVE-2026-46600?: Informational severity, published 21 July 2026.
Which products and versions are affected?: golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.56.0; stdlib (Go) SEMVER:introduced=1.26.0-0,fixed=1.26.6,introduced=1.27.0-0,fixed=1.27.0-rc.3; Google Dnsmessage < 0.56.0.
Is there a fix for CVE-2026-46600?: Yes. golang.org/x/net (Go): upgrade to 0.56.0 or later; stdlib (Go): upgrade to 1.27.0-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46600 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46600?: Check whether you run golang.org/x/net (Go), stdlib (Go) or Google Dnsmessage at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/net (Go): upgrade to 0.56.0 or later
```
go get golang.org/x/net@v0.56.0
```
stdlib (Go): upgrade to 1.27.0-rc.3 or later
```
go get stdlib@v1.27.0-rc.3
```

Technical details

A vulnerability exists in the golang.org/x/net/dns/dnsmessage package where parsing an invalid SVCB or HTTPS Resource Record (RR) can trigger a panic. The root cause is an integer overflow or bounds check failure that occurs when the size of a parameter value within the record exceeds the remaining message buffer during unpacking. This can be exploited by a remote attacker providing a malformed DNS response to an application using affected functions such as Message.Unpack or Parser.SVCBResource. The issue is fixed in version 0.56.0 of the golang.org/x/net library.

Affected products

Google golang.org/x/net/dns/dnsmessage < 0.56.0

Identifiers

CVE-2026-46600
GO-2026-5942

Timeline

2026-06-02: disclosed: Issue reported to Go project
2026-07-14: advisory: Go vulnerability report GO-2026-5942 published
2026-07-21: disclosed: CVE-2026-46600 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.