gopls, the Go language server, typically communicates via pipe, but supports -port and -listen flags for debugging. If these flags are used without specifying a host (e.g., using ':8080' or just -port), gopls binds to 0.0.0.0, listening on all network interfaces. This unrestricted binding (CWE-1327) can allow attackers on the same network to connect and execute arbitrary code through gopls. The vulnerability is documented as CVE-2026-42503. There is no CVSS score or vendor remediation information available at this time.

If exploited, this vulnerability allows a malicious actor on the same network to execute arbitrary code via gopls by connecting to the service bound on all interfaces. This could lead to unauthorized code execution on the affected system. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using the -listen or -port flags without specifying an explicit host address to prevent gopls from binding to 0.0.0.0. Restrict network access to the host running gopls to trusted users only.