CLEANSTART-2026-UZ24081: Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

Q: Which systems are affected?

The vulnerability affects the argo-workflows package on Windows. The provided information does not indicate impact on other operating systems.

Q: What must an attacker do to trigger the issue?

An attacker must provide input containing a NUL (0) character to the Dial or LookupPort functions. No privileges or user interaction are required according to the supplied severity vector.

Q: What is the practical impact of successful exploitation?

The affected functions panic, which can cause a denial of service. The supplied severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-39836

Frequently Asked Questions

Which systems are affected?

The vulnerability affects the argo-workflows package on Windows. The provided information does not indicate impact on other operating systems.

What must an attacker do to trigger the issue?

An attacker must provide input containing a NUL (0) character to the Dial or LookupPort functions. No privileges or user interaction are required according to the supplied severity vector.

What is the practical impact of successful exploitation?

The affected functions panic, which can cause a denial of service. The supplied severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

CLEANSTART-2026-UZ24081: Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are affected?

What must an attacker do to trigger the issue?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are affected?

What must an attacker do to trigger the issue?

What is the practical impact of successful exploitation?