gopls, the Go language server, normally communicates via pipes but supports debugging flags -port and -listen. If -listen is specified without an explicit host (e.g., :8080) or if -port is used, gopls binds to 0.0.0.0, listening on all network interfaces. This unrestricted binding can allow a malicious actor on the same network to connect and execute arbitrary code via gopls. The vulnerability is tracked as CVE-2026-42503 and classified under CWE-1327 (Binding to an Unrestricted IP Address). The CVSS 3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented.

If exploited, this vulnerability allows an unauthenticated attacker on the same network segment to connect to the gopls service bound on 0.0.0.0 and execute arbitrary code. This compromises confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the significant risk posed by this exposure. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the -listen flag without specifying an explicit host or the -port flag to prevent gopls from binding to all interfaces. Restrict network access to the machine running gopls to trusted users only. Monitor vendor communications for updates on patches or official mitigations.