{"id":"CVE-2026-42503","aliases":["DEBIAN-CVE-2026-42503","EUVD-2026-27872","GHSA-9344-f92h-vr44","RHSA-2026:7385","RHSA-2026:8291","UBUNTU-CVE-2026-42503"],"status":"published","title":"Accidental binding to INADDR_ANY might lead to RCE in golang.org/x/tools/gopls","description":"gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.\nIf -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. \nAs a result, users might inadvertently cause gopls to bind 0.0.0.0.\nThis can allow a malicious party on the same network to execute code arbitrarily via gopls.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00212,"percentile":0.11615,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1327"],"published":"2026-05-06T10:08:59Z","modified":"2026-10-27T23:00:24Z","fixes":[{"ecosystem":"Debian:14","package":"gopls","fixed_in":["2:0.22.0+ds-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"gopls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.16.1+ds-1","2:0.21.1+ds-1","2:0.21.1+ds-2","2:0.22.0+ds-1","2:0.22.0+ds-2","2:0.24.0+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"gopls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.22.0+ds-1"}]}],"versions":["2:0.16.1+ds-1","2:0.21.1+ds-1","2:0.21.1+ds-2"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25-shared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-shared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gopls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.16.1+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gopls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.16.1+ds-1","2:0.21.1+ds-2","2:0.22.0+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gopls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.16.1+ds-1"]}],"products":[{"vendor":"golang","product":"gopls"},{"vendor":"golang.org/x/tools","product":"golang.org/x/tools/gopls"}],"references":[{"url":"https://go.dev/issue/79211","tags":["Issue Tracking","Vendor Advisory","article"]},{"url":"https://go.dev/cl/774381","tags":["Patch","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42503","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9344-f92h-vr44"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42503","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7385","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27141","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58190","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-47911","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-22873","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68119","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61732","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61731","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61725","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61724","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61723","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58186","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58185","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58181","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-47914","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-47912","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-47910","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68121","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61730","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61729","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58189","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58187","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58188","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58183","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61728","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61726","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33809","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32289","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32288","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32283","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32282","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32281","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27144","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27143","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61727","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25679","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27139","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33813","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42503","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7385.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436992","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-22873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22873","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/05/06/2","tags":["article"]},{"url":"https://go.dev/cl/670036","tags":["article"]},{"url":"https://go.dev/issue/73555","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4403","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2397528","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47910","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47910","tags":["advisory"]},{"url":"https://go.dev/cl/699275","tags":["article"]},{"url":"https://go.dev/issue/75054","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3955","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437109","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47911","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47911","tags":["advisory"]},{"url":"https://github.com/golang/vulndb/issues/4440","tags":["article"]},{"url":"https://go.dev/cl/709876","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4440","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407247","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47912","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47912","tags":["advisory"]},{"url":"https://go.dev/cl/709857","tags":["article"]},{"url":"https://go.dev/issue/75678","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4010","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2416000","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47914","tags":["advisory"]},{"url":"https://go.dev/cl/721960","tags":["article"]},{"url":"https://go.dev/issue/76364","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4135","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2415997","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58181","tags":["advisory"]},{"url":"https://go.dev/cl/721961","tags":["article"]},{"url":"https://go.dev/issue/76363","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4134","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407258","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58183","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3122","tags":["article"]},{"url":"https://go.dev/cl/709861","tags":["article"]},{"url":"https://go.dev/issue/75677","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4014","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407251","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58185","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58185","tags":["advisory"]},{"url":"https://github.com/golang/go/commit/8709a41d5ef7321f486a1857f189c3fee20e8edd","tags":["article"]},{"url":"https://go.dev/cl/709856","tags":["article"]},{"url":"https://go.dev/issue/75671","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4011","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407250","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58186","tags":["advisory"]},{"url":"https://go.dev/cl/709855","tags":["article"]},{"url":"https://go.dev/issue/75672","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4012","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407259","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58187","tags":["advisory"]},{"url":"https://github.com/golang/go/commit/3fc4c79fdbb17b9b29ea9f8c29dd780df075d4c4","tags":["article"]},{"url":"https://go.dev/cl/709854","tags":["article"]},{"url":"https://go.dev/issue/75681","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4007","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407255","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58188","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58188","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407260","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58189","tags":["advisory"]},{"url":"https://go.dev/cl/707776","tags":["article"]},{"url":"https://go.dev/issue/75652","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4008","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437110","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58190","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58190","tags":["advisory"]},{"url":"https://github.com/golang/vulndb/issues/4441","tags":["article"]},{"url":"https://go.dev/cl/709875","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4441","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61723","tags":["advisory"]},{"url":"https://github.com/golang/go/commit/5ce8cd16f3859ec5ac4106ad8ec15d6236f4501b","tags":["article"]},{"url":"https://go.dev/cl/709858","tags":["article"]},{"url":"https://go.dev/issue/75676","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4009","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407257","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61724","tags":["advisory"]},{"url":"https://go.dev/cl/709859","tags":["article"]},{"url":"https://go.dev/issue/75716","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4015","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407249","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61725","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61725","tags":["advisory"]},{"url":"https://go.dev/cl/709860","tags":["article"]},{"url":"https://go.dev/issue/75680","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4006","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434432","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61726","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61726","tags":["advisory"]},{"url":"https://go.dev/cl/736712","tags":["article"]},{"url":"https://go.dev/issue/77101","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4341","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61727","tags":["advisory"]},{"url":"https://go.dev/cl/723900","tags":["article"]},{"url":"https://go.dev/issue/76442","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4175","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434431","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61728","tags":["advisory"]},{"url":"https://go.dev/cl/736713","tags":["article"]},{"url":"https://go.dev/issue/77102","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4342","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418462","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61729","tags":["advisory"]},{"url":"https://go.dev/cl/725920","tags":["article"]},{"url":"https://go.dev/issue/76445","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4155","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434430","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61730","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61730","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434433","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61731","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61731","tags":["advisory"]},{"url":"https://go.dev/cl/736711","tags":["article"]},{"url":"https://go.dev/issue/77100","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4339","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437016","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61732","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61732","tags":["advisory"]},{"url":"https://go.dev/cl/734220","tags":["article"]},{"url":"https://go.dev/issue/76697","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4433","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434438","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68119","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68119","tags":["advisory"]},{"url":"https://go.dev/cl/736710","tags":["article"]},{"url":"https://go.dev/issue/77099","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4338","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437111","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68121","tags":["advisory"]},{"url":"https://go.dev/cl/737700","tags":["article"]},{"url":"https://go.dev/issue/77217","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4337","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445356","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679","tags":["advisory"]},{"url":"https://go.dev/cl/752180","tags":["article"]},{"url":"https://go.dev/issue/77578","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4601","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27139","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27139","tags":["advisory"]},{"url":"https://go.dev/cl/749480","tags":["article"]},{"url":"https://go.dev/issue/77827","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4602","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2443104","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27141","tags":["advisory"]},{"url":"https://go.dev/cl/746180","tags":["article"]},{"url":"https://go.dev/issue/77652","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4559","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27143","tags":["advisory"]},{"url":"https://go.dev/cl/763765","tags":["article"]},{"url":"https://go.dev/issue/78333","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4868","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456340","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27144","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27144","tags":["advisory"]},{"url":"https://go.dev/cl/763764","tags":["article"]},{"url":"https://go.dev/issue/78371","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4867","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456333","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","tags":["advisory"]},{"url":"https://go.dev/cl/758061","tags":["article"]},{"url":"https://go.dev/issue/78281","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4946","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32282","tags":["advisory"]},{"url":"https://go.dev/cl/763761","tags":["article"]},{"url":"https://go.dev/issue/78293","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4864","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32283","tags":["advisory"]},{"url":"https://go.dev/cl/763767","tags":["article"]},{"url":"https://go.dev/issue/78334","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4870","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456332","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32288","tags":["advisory"]},{"url":"https://go.dev/cl/763766","tags":["article"]},{"url":"https://go.dev/issue/78301","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4869","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456334","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32289","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32289","tags":["advisory"]},{"url":"https://go.dev/cl/763762","tags":["article"]},{"url":"https://go.dev/issue/78331","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4865","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451437","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33809","tags":["advisory"]},{"url":"https://go.dev/cl/757660","tags":["article"]},{"url":"https://go.dev/issue/78267","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4815","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460221","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33813","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33813","tags":["advisory"]},{"url":"https://go.dev/cl/759860","tags":["article"]},{"url":"https://go.dev/issue/78407","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4961","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42503","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8291","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8291.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-42503","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-42503","title":"Accidental binding to INADDR_ANY might lead to RCE in golang.org/x/tools/gopls","description":"gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.\nIf -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. \nAs a result, users might inadvertently cause gopls to bind 0.0.0.0.\nThis can allow a malicious party on the same network to execute code arbitrarily via gopls.","status":"published","published":"2026-05-06T16:20:01.428Z","modified":"2026-05-07T03:55:49.73Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1327"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-27872","description":"gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.\nIf -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. \nAs a result, users might inadvertently cause gopls to bind 0.0.0.0.\nThis can allow a malicious party on the same network to execute code arbitrarily via gopls.","status":"published","published":"2026-05-06T16:20:01Z","modified":"2026-05-07T03:55:49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:05:15.738879Z"}],"ghsa":[{"id":"GHSA-9344-f92h-vr44","title":"gopls by default communicates via pipe. However, -port and -listen flags are supported as means...","description":"gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.\nIf -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. \nAs a result, users might inadvertently cause gopls to bind 0.0.0.0.\nThis can allow a malicious party on the same network to execute code arbitrarily via gopls.","status":"published","published":"2026-05-06T18:30:31Z","modified":"2026-05-06T18:30:42Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1327"],"updated_at":"2026-11-02T15:07:55.247215Z"}],"nvd":[{"id":"CVE-2026-42503","description":"gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.\nIf -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. \nAs a result, users might inadvertently cause gopls to bind 0.0.0.0.\nThis can allow a malicious party on the same network to execute code arbitrarily via gopls.","status":"published","published":"2026-05-06T17:16:23.417Z","modified":"2026-10-26T19:10:00.163Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1327"],"updated_at":"2026-11-02T14:12:17.418622Z"}],"osv":[{"id":"DEBIAN-CVE-2026-42503","description":"gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.  As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.","status":"published","published":"2026-05-06T17:16:23.417Z","modified":"2026-10-27T23:00:24.08495178Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:55.251751Z"},{"id":"RHSA-2026:7385","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-15T10:18:16Z","modified":"2026-10-20T10:15:22Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:8291","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-06T10:08:59Z","modified":"2026-10-17T10:21:08Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-42503","description":"gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.","status":"published","published":"2026-05-06T17:16:00Z","modified":"2026-10-17T13:00:05.334652549Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"}]}}