CVE-2026-42503High· 8.8▾ Twilightgopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. As a result…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.3%
gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.
gopls < 0.22.0Upgrade past the affected range:
gopls 0.22.0Connected by shared product, vendor, weakness, or advisory.
CVE-2022-32189High· 7.5A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.
CVE-2025-61724Medium· 5.3The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines
CVE-2025-61723High· 7.5The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input
CVE-2025-58189Medium· 5.3When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.
CVE-2025-58187High· 7.5Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate
CVE-2025-58185Medium· 5.3Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.