CVE-2026-39836High· 7.5▾ Twilight

net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836)

A flaw was found in the `net` package of Go (golang). When running on Windows, the `Dial` and `LookupPort` functions can panic if they receive an input containing a NUL (0) byte. This can be triggered by a remote attacker providing a speci…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 7, 2026

Updated

Oct 21, 2026

CVSS

7.5

Vendor

Red Hat

Product

Red Hat Enterprise Linux AppStream (v. 8)

CWE

CWE-617

Depth score

41 · Moderate

EPSS

0.63% · p50

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Aug 1.

0.6% → 0.6%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

6 events · 172 days

May 7, 2026Published
Disclosed via CSAF
Aug 1, 2026EPSS first tracked
0.6%
Sep 22, 2026CVSS changed
— → 7.5
Sep 22, 2026Severity changed
none → high
Oct 21, 2026Record revised
Last analysed / modified upstream
Oct 26, 2026EPSS peak
0.6% → 0.6%

Red Hat CWE-617 #csaf #vex #red-hat #osv #go

Affected

Patched in

enterprise_linux_appstream_v_10
enterprise_linux_appstream_v_8
enterprise_linux_appstream_v_9
advanced_cluster_security_for_kubernetes 4.10
hardened_images
openshift_gitops 1.19
web_terminal 1.11
web_terminal 1.12
web_terminal 1.13
web_terminal 1.14
web_terminal 1.15
web_terminal 1.16
multicluster_engine_for_kubernetes 2.11

Full technical detail▾

Overview

A flaw was found in the net package of Go (golang). When running on Windows, the Dial and LookupPort functions can panic if they receive an input containing a NUL (0) byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service (DoS) for applications using these functions.

Vendor advisories

RHSA-2026:22120 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-06-01 · advisory
RHSA-2026:22112 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-01 · advisory
RHSA-2026:22121 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-06-01 · advisory
RHSA-2026:36625 · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.10 · released 2026-07-08 · advisory
RHSA-2026:23262 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-04 · advisory
RHSA-2026:23264 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-04 · advisory
RHSA-2026:52857 · Red Hat · fixed in: Red Hat OpenShift GitOps 1.19 · released 2026-08-10 · advisory
RHSA-2026:55901 · Red Hat · fixed in: Red Hat Web Terminal 1.11 · released 2026-08-18 · advisory
RHSA-2026:55898 · Red Hat · fixed in: Red Hat Web Terminal 1.12 · released 2026-08-18 · advisory
RHSA-2026:55902 · Red Hat · fixed in: Red Hat Web Terminal 1.13 · released 2026-08-18 · advisory
RHSA-2026:55903 · Red Hat · fixed in: Red Hat Web Terminal 1.14 · released 2026-08-18 · advisory
Red Hat VEX · Moderate · affected: Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, Cryostat 4, Custom Metric Autoscaler operator for Red Hat Openshift, Deployment Validation Operator, … · no fix planned: OpenShift Lightspeed, Red Hat 3scale API Management Platform 2, Red Hat Edge Manager 1, Builds for Red Hat OpenShift, … · updated 2026-10-21 · vex
RHSA-2026:55900 · Red Hat · fixed in: Red Hat Web Terminal 1.15 · released 2026-08-18 · advisory

net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows — rated Moderate by Red Hat. Released 2026-05-07, updated 2026-10-21.

Affected:

Builds for Red Hat OpenShift
cert-manager Operator for Red Hat OpenShift
Confidential Compute Attestation
Cryostat 4
Custom Metric Autoscaler operator for Red Hat Openshift
Deployment Validation Operator
External Secrets Operator for Red Hat OpenShift
Migration Toolkit for Applications 8
mirror registry for Red Hat OpenShift
Multicluster Engine for Kubernetes
Multicluster Global Hub
Network Observability Operator
OpenShift API for Data Protection
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Service Mesh 2
Power monitoring for Red Hat OpenShift
Red Hat 3scale API Management Platform 2
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat AMQ Clients
Red Hat Ansible Automation Platform 2
Red Hat build of Apicurio Registry 2
Red Hat Ceph Storage 5
Red Hat Ceph Storage 6
Red Hat Ceph Storage 9
Red Hat Certification Program for Red Hat Enterprise Linux 9
Red Hat Connectivity Link 1
Red Hat Edge Manager 1
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat Lightspeed for Runtimes Operator
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Dev Spaces
Red Hat OpenShift Dev Workspaces Operator
Red Hat OpenShift distributed tracing 3
Red Hat OpenShift GitOps
Red Hat Service Interconnect 1
Red Hat Trusted Artifact Signer

Fixed:

Red Hat Enterprise Linux AppStream (v. 10)
Red Hat Enterprise Linux AppStream (v. 8)
Red Hat Enterprise Linux AppStream (v. 9)
Red Hat Advanced Cluster Security for Kubernetes 4.10
Red Hat Hardened Images
Red Hat OpenShift GitOps 1.19
Red Hat Web Terminal 1.11
Red Hat Web Terminal 1.12
Red Hat Web Terminal 1.13
Red Hat Web Terminal 1.14
Red Hat Web Terminal 1.15
Red Hat Web Terminal 1.16
multicluster engine for Kubernetes 2.11

No fix planned:

OpenShift Lightspeed
Red Hat 3scale API Management Platform 2
Red Hat Edge Manager 1
Builds for Red Hat OpenShift
cert-manager Operator for Red Hat OpenShift
Confidential Compute Attestation
Cryostat 4
Custom Metric Autoscaler operator for Red Hat Openshift
Deployment Validation Operator
External Secrets Operator for Red Hat OpenShift
Migration Toolkit for Applications 8
mirror registry for Red Hat OpenShift
Multicluster Engine for Kubernetes
Multicluster Global Hub
Network Observability Operator
OpenShift API for Data Protection
OpenShift Pipelines
OpenShift Service Mesh 2
Power monitoring for Red Hat OpenShift
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat AMQ Clients
Red Hat Ansible Automation Platform 2
Red Hat build of Apicurio Registry 2
Red Hat Ceph Storage 5
Red Hat Ceph Storage 6
Red Hat Ceph Storage 9
Red Hat Certification Program for Red Hat Enterprise Linux 9
Red Hat Connectivity Link 1
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat Lightspeed for Runtimes Operator
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Dev Spaces
Red Hat OpenShift Dev Workspaces Operator
Red Hat OpenShift distributed tracing 3
Red Hat OpenShift GitOps
Red Hat Service Interconnect 1
Red Hat Trusted Artifact Signer

Not affected:

Red Hat Advanced Cluster Security for Kubernetes 4.10
Red Hat OpenShift GitOps 1.19
Red Hat Web Terminal 1.11
Red Hat Web Terminal 1.12
Red Hat Web Terminal 1.13
Red Hat Web Terminal 1.14
Red Hat Web Terminal 1.15
Red Hat Web Terminal 1.16
Assisted Installer for Red Hat OpenShift Container Platform 2
Compliance Operator

Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:22120 For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:22112 For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:22121

Workarounds / mitigations:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Package advisory (CVE-2026-39836)

Affected packages:

stdlib >= 1.26.0-0, < 1.26.3

Patched in:

stdlib 1.26.3

Source: https://osv.dev/vulnerability/GO-2026-4971

References

Change history

Field changes observed since this record was first indexed.

Sep 22, 2026CVSS — → 7.5
Sep 22, 2026Severity none → high

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#go

← Back to feed