CVE-2026-42503

gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.  As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.

• CWE-1327

• https://go.dev/cl/774381
• https://go.dev/issue/79211

Published

May 6, 2026

Last Modified

Jun 17, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42498Exposure of HTTP Authentication Header to unexpected hosts d…7.3
• CVE-2026-42499Pathological inputs could cause DoS through consumePhrase wh…7.5
• CVE-2026-4250A vulnerability was found in Albert Sağlık Hizmetleri ve Tic…2.5
• CVE-2026-42500Decoding a paletted BMP file with an out-of-range palette in…5.3
• CVE-2026-42501A malicious module proxy can exploit a flaw in the go comman…7.5
• CVE-2026-42502Parsing arbitrary HTML which is then rendered using Render c…6.1
• CVE-2026-42504Decoding a maliciously-crafted MIME header containing many i…7.5
• CVE-2026-42505Handshakes which used Encrypted Client Hello could be de-ano…5.3
• CVE-2026-42506Parsing arbitrary HTML which is then rendered using Render c…6.1
• CVE-2026-42507When returning errors, functions in the net/textproto packag…5.3
• CVE-2026-42508Previously, a revoked 'SignatureKey' belonging to a CA was n…9.1
• CVE-2026-42509Improper Neutralization of Input During Web Page Generation …6.1