Threats affecting pkg:golang/golang.org/x/tools/gopls

The golang.org/x/tools/gopls language server has a vulnerability where it may bind to the unrestricted IP address 0.0.0.0 when started with certain debugging flags (-listen without explicit host or -port). This behavior can expose the service to network attackers on the same network, potentially allowing arbitrary code execution. The vulnerability is rated high severity with a CVSS score of 8.8. No official patch or remediation guidance is currently provided by the vendor. Users should be cautious when using these flags and avoid binding gopls to all network interfaces unless necessary.