Panic in Dial and LookupPort when handling NUL byte on Windows in net

HIGH 7.5CVE-2026-39836 · BIT-golang-2026-39836 · GO-2026-4971 · Published 07/05/2026 · updated 26/10/2026

In short

CVE-2026-39836 is a HIGH (CVSS 7.5) vulnerability affecting stdlib, go (golang).
Chance of exploitation in the next 30 days (EPSS): 0.63%, higher than 50.3% of all vulnerabilities.
Fix: update to 1.26.3, 1.25.10 or later.

Package	Affected versions	Patched versions
stdlib Go	`≥ 1.26.0-0, < 1.26.3< 1.25.10`	`1.26.31.25.10`
go golang	`≥ 1.26.0, < 1.26.3< 1.25.10`	`1.26.31.25.10`

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

NVD description

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 1.26.0-0, < 1.26.3< 1.25.10

1.26.31.25.10

≥ 1.26.0, < 1.26.3< 1.25.10

1.26.31.25.10

More vulnerabilities in stdlib

See all →