CVE-2026-42503: Accidental binding to INADDR_ANY might lead to RCE in golang.org/x/tools/gopls
gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42503?
The severity of CVE-2026-42503 is significant due to the risk of remote code execution if exploited.
How do I fix CVE-2026-42503?
To fix CVE-2026-42503, ensure that the gopls command does not bind to INADDR_ANY by explicitly specifying the host address.
What versions of gopls are affected by CVE-2026-42503?
CVE-2026-42503 affects all versions of gopls that bind to INADDR_ANY without an explicit host.
Can CVE-2026-42503 be exploited without proper network controls?
Yes, CVE-2026-42503 can be exploited if network controls are not in place to limit access to the gopls service.
What should I monitor to detect exploitation of CVE-2026-42503?
Monitor for unusual access patterns and unauthorized requests to the gopls service listening ports, which may indicate attempts to exploit CVE-2026-42503.