Skip to content

net: panic in Dial and LookupPort when handling NUL byte on Windows (fix CVE-2026-39836) #79006

Description

@thatnealpatel

The Dial and LookupPort functions would panic on Windows when provided
with an input containing a NUL (0). These functions now return an error
rather than panicking.

This is CVE-2026-39836 and Go issue https://go.dev/issue/79006.


This was a PRIVATE track issue, tracked in http://b/502138517.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    NeedsFixThe path to resolution is known, but the work has not been done.Securityrelease-blockervulncheck or vulndbIssues for the x/vuln or x/vulndb repo

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions