CVE-2026-39836: Panic in Dial and LookupPort when handling NUL byte on Windows in net
Published May 7, 2026
·Updated
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
Affected Software
3 affected components
Google Go standard library (net)
Golang Go<1.25.10
Golang Go>=1.26.0<1.26.3
Remediation
Patch Available
Event History
May 7, 2026
CVE Published
via MITRE·07:41 PM
Data Sourced
via MITRE·07:41 PM
DescriptionWeakness
Data Sourced
via NVD·08:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-39836?
CVE-2026-39836 is rated as a medium severity vulnerability due to its potential to cause application crashes.
2
How do I fix CVE-2026-39836?
To fix CVE-2026-39836, update to the latest version of the Google Go standard library that addresses this vulnerability.
3
What types of systems are affected by CVE-2026-39836?
CVE-2026-39836 affects Windows systems using the Google Go standard library's net package.
4
What specific functions are involved in CVE-2026-39836?
CVE-2026-39836 involves the Dial and LookupPort functions within the net package.
5
What impact does CVE-2026-39836 have on applications?
CVE-2026-39836 can lead to application crashes when handling inputs that contain a NUL byte.