Description
gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.
If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.
As a result, users might inadvertently cause gopls to bind 0.0.0.0.
This can allow a malicious party on the same network to execute code arbitrarily via gopls.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| golang.org/x/tools | golang.org/x/tools/gopls | 0.0.0 – < 0.22.0 | 0.22.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gopls | 2:0.22.0+ds-1 | — |
| Debian 13 | gopls | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | gopls | No fix yet | — |
| Ubuntu 26.04 LTS | gopls | No fix yet | — |
| Ubuntu 25.10 | gopls | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | golang1.25 +6 | 1.25.9-1.hum1 | RHSA-2026:7385 |
| Red Hat Hardened Images 1 | golang1.26 +6 | 1.26.2-1.1.hum1 | RHSA-2026:8291 |
Advisories 2
- RHSA-2026:7385 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:8291 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026