Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

높음 7.5CVE-2026-46600 · BIT-golang-2026-46600 · GO-2026-5942 · Published 21/07/2026 · updated 24/10/2026

요약

Package	Affected versions	Patched versions
golang.org/x/net Go	`< 0.56.0`	`0.56.0`
stdlib Go	`≥ 1.26.0-0, < 1.26.6≥ 1.27.0-0, < 1.27.0-rc.3`	`1.26.61.27.0-rc.3`

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

NVD description

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 0.56.0

0.56.0

≥ 1.26.0-0, < 1.26.6≥ 1.27.0-0, < 1.27.0-rc.3

1.26.61.27.0-rc.3

golang.org/x/net의 다른 취약점

모두 보기 →