Threats affecting pkg:golang/net

3 threats

Severity	CVSS	Signals	Threat	Source	Published
High	7.5	EPSS 0.5%	CVE-2026-46600Go standard library net · Out-of-bounds Read High7.5EPSS 0.5%2026-07-21CVE Database V5CVE-2026-46600 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. EPSS 0.5%Vulnerability CWE-125	CVE Database V5	2026-07-21
High	7.5	EPSS 0.6%	CVE-2026-39836Go standard library net · Uncaught Exception High7.5EPSS 0.6%2026-05-07CVE Database V5CVE-2026-39836 CVE-2026-39836 is a high-severity vulnerability in the Go standard library's net package on Windows platforms. The Dial and LookupPort functions panic when given input containing a NUL (0) character, causing an uncaught exception that can crash the application. This results in a denial of service condition. There is no impact on confidentiality or integrity reported. No official patch or remediation guidance is currently available, and no exploits are known in the wild. EPSS 0.6%Vulnerability CWE-248 #microsoft-security-response-ce	CVE Database V5	2026-05-07
High	7.5	EPSS 0.9%	CVE-2026-33811Go standard library net · Double Free High7.5EPSS 0.9%2026-05-07CVE Database V5CVE-2026-33811 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. EPSS 0.9%Vulnerability CWE-415	CVE Database V5	2026-05-07

Page 1 of 1