This vulnerability affects the Go standard library net package versions up to 1.26.0-0 on Windows. When the Dial or LookupPort functions receive input containing a NUL character, they trigger a panic due to an uncaught exception. This behavior leads to application crashes, causing denial of service. The vulnerability is identified as CWE-248 (Uncaught Exception). There is no indication of impact on data confidentiality or integrity. The CVSS 3.1 base score is 7.5, reflecting a high severity denial of service via network attack vector with no privileges or user interaction required. No official patch or remediation guidance has been published by the vendor as of the publication date.

The primary impact is denial of service caused by application crashes when the vulnerable functions process inputs containing NUL characters. There is no reported impact on confidentiality or integrity of data. No known exploits exist in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider input validation or sanitization to prevent NUL characters from reaching the Dial and LookupPort functions in the Go net package on Windows platforms. Monitor vendor communications for updates.