CVE-2026-46600: Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Published Jul 21, 2026
·Updated
Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Other sources
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
— NVD
Affected Software
3 affected componentsFixes available
golang.org/x/net/dns/dnsmessage
Microsoft azl3 golang 1.26.5-2<1.26.6-1
1.26.6-1
alpine/go<1.26.8-r0
1.26.8-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.26.6-1 - Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.8-r0
Event History
Jul 21, 2026
CVE Published
via MITRE·07:18 PM
Data Sourced
via MITRE·07:18 PM
DescriptionWeakness
Data Sourced
via Red Hat·08:02 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Data Sourced
via OSV·08:17 PM
DescriptionSeverityAffected Software
Jul 25, 2026
Data Sourced
via Microsoft·08:05 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:05 AM
Affected Software