CVE-2026-39836: Panic in Dial and LookupPort when handling NUL byte on Windows in net
Panic in Dial and LookupPort when handling NUL byte on Windows in net
Other sources
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.25.10-r0 - Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.3-r0 - Upgrade
Upgrade
alpine/rcloneto a version that resolves this vulnerability.Fixed in 1.74.1-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39836?
CVE-2026-39836 is rated as a medium severity vulnerability due to its potential to cause application crashes.
How do I fix CVE-2026-39836?
To fix CVE-2026-39836, update to the latest version of the Google Go standard library that addresses this vulnerability.
What types of systems are affected by CVE-2026-39836?
CVE-2026-39836 affects Windows systems using the Google Go standard library's net package.
What specific functions are involved in CVE-2026-39836?
CVE-2026-39836 involves the Dial and LookupPort functions within the net package.
What impact does CVE-2026-39836 have on applications?
CVE-2026-39836 can lead to application crashes when handling inputs that contain a NUL byte.