CVE-2026-39836

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

*Credits: N/A

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2026-04-07 CVE Reserved
2026-05-07 CVE Published
2026-05-13 CVE Updated
2026-05-14 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-476: NULL Pointer Dereference

CAPEC

References (4)

URL	Tag	Source
https://go.dev/issue/79006	Issue Tracking
https://groups.google.com/g/golang-announce/c/qcCIEXso47M	Issue Tracking

URL	Date	SRC

URL	Date	SRC
https://go.dev/cl/775320	2026-05-08

URL	Date	SRC
https://pkg.go.dev/vuln/GO-2026-4971	2026-05-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Golang Search vendor "Golang"		Go Search vendor "Golang" for product "Go"				< 1.25.10 Search vendor "Golang" for product "Go" and version " < 1.25.10"		-		Affected
Golang Search vendor "Golang"		Go Search vendor "Golang" for product "Go"				>= 1.26.0 < 1.26.3 Search vendor "Golang" for product "Go" and version " >= 1.26.0 < 1.26.3"		-		Affected