CVE-2026-42503

Name
CVE-2026-42503
Description
gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.  As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security@golang.org https://go.dev/cl/774381
security@golang.org https://go.dev/issue/79211

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:golang:gopls:*:*:*:*:*:go:*:* gopls >= None < 0.22.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
gopls edge-community 0.21.1-r4 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.21.1-r3 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.21.1-r2 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.21.1-r1 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.21.1-r0 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.21.0-r2 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.21.0-r1 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.21.0-r0 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.20.0-r4 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.20.0-r3 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.20.0-r2 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.20.0-r1 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.20.0-r0 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.19.1-r1 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.19.1-r0 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.19.0-r0 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.18.1-r0 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.18.0-r3 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.18.0-r2 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.18.0-r1 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.18.0-r0 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.17.1-r2 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.17.1-r1 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.17.1-r0 David Florness <david@florness.com> possibly vulnerable
gopls edge-community 0.16.2-r1 David Florness <david@florness.com> possibly vulnerable
gopls 3.24-community 0.21.1-r4 David Florness <david@florness.com> possibly vulnerable
gopls 3.24-community 0.21.1-r3 David Florness <david@florness.com> possibly vulnerable