Skip to content
OpenAdvisories
High · 7.5 CVE-2026-46600 BIT-golang-2026-46600EUVD-2026-46383GHSA-gg3m-vvp2-p2c5GO-2026-5942

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Published Jul 21, 2026 · Updated Aug 14, 2026 · Assigned by Go

Vendor: Go standard library Vendor: golang.org/x/net Product: golang.org/x/net/dns/dnsmessage Product: net Package: aactl Package: amazon-cloudwatch-agent-operator Package: argo-cd-3.4 Package: argo-cd-3.4-compat Package: aws-nuke Package: aws-otel-collector Package: azurefile-csi-1.35 Package: bento Package: cadvisor Package: cadvisor-compat Package: cerbos Package: cert-manager-1.20 Package: cert-manager-1.20-crds Package: cert-manager-acmesolver-1.20 Package: cert-manager-cainjector-1.20 Package: cert-manager-controller-1.20 Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: cilium-1.19 Package: cilium-1.19-clustermesh-apiserver Package: cilium-1.19-hubble-relay Package: cilium-1.19-operator-aws Package: cilium-1.19-operator-generic Package: cilium-cli Package: cloud-provider-aws-1.36-cloud-controller-manager Package: cloud-provider-azure-cloud-controller-manager-1.36 Package: cloud-provider-azure-cloud-controller-manager-1.36-compat Package: cloud-provider-azure-cloud-node-manager-1.36 Package: cloudnative-pg Package: cloudnative-pg-plugins Package: cluster-api-azure-controller Package: cluster-api-azure-controller-compat Package: containerd-1 Package: containerd-2 Package: containerd-2.3 Package: containerd-shim-runc-v2-1 Package: containerd-shim-runc-v2-2 Package: containerd-shim-runc-v2-2.3 Package: containerd-stress-1 Package: containerd-stress-2 Package: containerd-stress-2.3 Package: coredns-1.14 Package: cosign-3 Package: crossplane-provider-keycloak Package: ctop Package: ctr-1 Package: ctr-2 Package: ctr-2.3 Package: datadog-agent-7.79 Package: datadog-agent-7.81-fakeintake Package: datadog-agent-7.81-full Package: dataplaneapi Package: dex Package: dogstatsd-7.72 Package: dogstatsd-7.73 Package: dogstatsd-7.77 Package: dogstatsd-7.78 Package: dogstatsd-7.79 Package: dogstatsd-7.80 Package: dogstatsd-7.81 Package: elvish Package: envconsul Package: external-dns-0.21 Package: falco-no-driver Package: flux-2.7 Package: flux-2.8 Package: flux-2.9 Package: flux-image-automation-controller Package: flux-image-reflector-controller Package: flux-kustomize-controller Package: flux-kustomize-controller-iamguarded-compat Package: flux-notification-controller Package: flux-source-controller Package: fscrypt Package: fuse-overlayfs-snapshotter Package: gh Package: gitlab-agent-19.2 Package: gitlab-docker-machine-18.11 Package: gitlab-kas-19.2 Package: gitlab-runner-18.11 Package: gitlab-runner-helper-18.11 Package: go Package: golang Package: golang-1.23 Package: golang-golang-x-net Package: golang.org/x/net Package: golangci-lint Package: gpu-feature-discovery Package: grafana-alloy Package: grafana-image-renderer Package: grafana-rollout-operator Package: grype Package: helm-3 Package: helm-operator Package: hubble Package: infinispan-operator Package: istio-cni-1.29 Package: istio-install-cni-1.29 Package: istio-pilot-agent-1.29 Package: istio-pilot-discovery-1.29 Package: istioctl-1.29 Package: k3d Package: k3s Package: k3s-1.32 Package: k3s-1.34 Package: k3s-1.35 Package: k3s-multicall Package: k3s-multicall-1.32 Package: k3s-multicall-1.34 Package: k3s-multicall-1.35 Package: k3s-static Package: k3s-static-1.32 Package: k3s-static-1.34 Package: k3s-static-1.35 Package: k6 Package: kaf Package: kine Package: kitty Package: ko Package: krane Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-fluentd-operator Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-proxy-1.35-default-compat Package: kube-proxy-1.36 Package: kube-rbac-proxy Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kube-scheduler-1.35-default-compat Package: kube-scheduler-1.36 Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubectl-1.32 Package: kubectl-1.33 Package: kubectl-1.34 Package: kubectl-1.35 Package: kubectl-1.36 Package: kubectl-bash-completion-1.35 Package: kubelet-1.34 Package: kubelet-1.35 Package: kubelet-1.36 Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubernetes-dashboard Package: kubernetes-pause-compat-1.35 Package: kubo Package: kubo-compat Package: kuma-coredns-1.14 Package: kustomize Package: kyverno-1.17 Package: kyverno-1.18 Package: kyverno-background-controller-1.17 Package: kyverno-background-controller-1.18 Package: kyverno-cleanup-controller-1.17 Package: kyverno-cleanup-controller-1.18 Package: kyverno-cli-1.17 Package: kyverno-cli-1.18 Package: kyverno-init-container-1.17 Package: kyverno-init-container-1.18 Package: kyverno-policy-reporter Package: kyverno-readiness-checker-1.17 Package: kyverno-readiness-checker-1.18 Package: kyverno-reports-controller-1.17 Package: kyverno-reports-controller-1.18 Package: loki-3.6 Package: loki-3.6-logcli Package: loki-3.6-loki-canary Package: loki-3.6-promtail Package: loki-3.7 Package: loki-3.7-logcli Package: loki-3.7-loki-canary Package: melange Package: metrics-server Package: metrics-server-compat Package: minio Package: mps-control-daemon Package: nsc Package: nvidia-device-plugin Package: opentelemetry-collector Package: opentelemetry-collector-contrib Package: pg_timetable Package: pg_user Package: pgpool2_exporter Package: podman-6.0 Package: prometheus-admission-webhook Package: prometheus-config-reloader Package: prometheus-operator Package: prometheus-operator-iamguarded-compat Package: pulumi-language-java Package: pulumi-language-yaml Package: rabbitmq-messaging-topology-operator Package: rabbitmq-messaging-topology-operator-iamguarded-compat Package: rancher-2.14 Package: rancher-agent-2.13 Package: rancher-agent-2.14 Package: rancher-fleet Package: rancher-fleet-agent Package: rancher-fleet-cli Package: rancher-fleet-controller Package: ratify Package: ratify-schemavalidator Package: ratify-vulnerabilityreport Package: rekor-cli Package: renovate Package: rqlite Package: ruby3.3-fluent-plugin-grafana-loki-3.7 Package: runc Package: runc-1.4 Package: seaweedfs Package: sftpgo Package: sftpgo-plugin-auth Package: sftpgo-plugin-eventsearch Package: sftpgo-plugin-geoipfilter Package: sftpgo-plugin-pubsub Package: snyk-cli Package: speedtest-go Package: spicedb-operator Package: spire-agent Package: spire-oidc-discovery-provider Package: spire-server Package: splunk-otel-collector Package: splunk-otel-collector-compat Package: sql_exporter Package: stdlib Package: step-issuer Package: step-issuer-compat Package: syft Package: tailscale Package: tailscale-k8s-operator Package: task Package: tekton-chains Package: telegraf-1.38 Package: terraform-provider-azapi Package: terraform-provider-azurerm Package: terraform-provider-google Package: terragrunt Package: timestamp-authority-server Package: timoni Package: trino Package: trino-plugin-bigquery Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-teradata-functions Package: vendir Package: vexctl Package: victoriametrics-operator Package: victoriametrics-vmalert Package: victoriametrics-vmalert-cluster Package: zarf Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Affected products

VendorProductAffectedFixed
Go standard library net 1.26.0-0 – < 1.26.6, 1.27.0-0 – < 1.27.0-rc.3 1.26.6
golang.org/x/net golang.org/x/net/dns/dnsmessage < 0.56.0 0.56.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-golang-x-net 1:0.56.0-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS golang-1.23 No fix yet —
Ubuntu 24.04 LTS golang-1.23 No fix yet —
Ubuntu 22.04 LTS golang-1.23 No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 alloy 1.19.2-150700.15.29.1 SUSE-SU-2026:4408-1
SLES 15 SP7 kubevirt 1.7.4-150700.3.33.1 SUSE-SU-2026:3480-1
SLES 15 SP7 kubevirt-1.6 1.6.6-150700.15.17.1 SUSE-SU-2026:3630-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 alloy 1.19.2-160000.1.1 SUSE-SU-2026:24148-1
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1
SLES 16.0 alloy 1.19.2-160000.1.1 SUSE-SU-2026:24148-1
SLES 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed alloy 1.19.2-1.1 openSUSE-SU-2026:11803-1
openSUSE Tumbleweed flannel 0.28.10-1.1 openSUSE-SU-2026:12270-1
openSUSE Tumbleweed kubevirt1.8 1.8.4-3.1 openSUSE-SU-2026:11392-1
openSUSE Tumbleweed rclone 1.75.1-1.1 openSUSE-SU-2026:11727-1
openSUSE Leap 16.0 alloy 1.19.2-160000.1.1 openSUSE-SU-2026:22032-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21761-1, openSUSE-SU-2026:21483-1
openSUSE Leap 16.0 kubevirt1.8 1.8.4-160000.1.1 openSUSE-SU-2026:21590-1
openSUSE Leap 16.0 rclone 1.75.1-bp160.1.1 openSUSE-SU-2026:21999-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.26.8-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r64 —
Wolfi rolling amazon-cloudwatch-agent-operator 3.7.0-r1 —
Wolfi rolling argo-cd-3.4 +1 3.4.7-r2 —
Wolfi rolling aws-nuke 3.66.0-r1 —
Wolfi rolling aws-otel-collector 0.49.0-r3 —
Wolfi rolling azurefile-csi-1.35 1.35.7-r1 —
Wolfi rolling bento 1.20.0-r1 —
Wolfi rolling cadvisor 0.60.5-r2 —
Wolfi rolling cadvisor-compat 0.60.5-r8 —
Wolfi rolling cerbos 0.55.0-r7 —
Wolfi rolling cert-manager-1.20 +5 1.20.3-r7 —
Wolfi rolling cert-manager-1.20-crds 1.20.3-r18 —
Wolfi rolling cilium-1.19 +4 1.19.6-r2 —
Wolfi rolling cilium-cli 0.19.7-r2 —
Wolfi rolling cloud-provider-aws-1.36-cloud-controller-manager 1.36.1-r3 —
Wolfi rolling cloud-provider-azure-cloud-controller-manager-1.36-compat 1.36.6-r0 —
Wolfi rolling cloud-provider-azure-cloud-node-manager-1.36 +1 1.36.5-r1 —
Wolfi rolling cloudnative-pg +1 1.30.0-r4 —
Wolfi rolling cluster-api-azure-controller 1.26.0-r5 —
Wolfi rolling cluster-api-azure-controller-compat 1.27.0-r1 —
Wolfi rolling coredns-1.14 +1 1.14.6-r3 —
Wolfi rolling cosign-3 3.1.3-r1 —
Wolfi rolling crossplane-provider-keycloak 2.24.1-r1 —
Wolfi rolling ctop 0.7.7-r40 —
Wolfi rolling ctr-1 +3 1.7.34-r2 —
Wolfi rolling ctr-2 +7 2.3.3-r2 —
Wolfi rolling dataplaneapi 3.4.1-r1 —
Wolfi rolling dex 2.45.1-r21 —
Wolfi rolling dogstatsd-7.73 7.73.3-r23 —
Wolfi rolling dogstatsd-7.77 7.77.3-r23 —
Wolfi rolling dogstatsd-7.78 7.78.4-r16 —
Wolfi rolling dogstatsd-7.79 +1 7.79.2-r16 —
Wolfi rolling dogstatsd-7.80 7.80.4-r10 —
Wolfi rolling dogstatsd-7.81 +2 7.81.3-r1 —
Wolfi rolling elvish 0.21.0-r18 —
Wolfi rolling envconsul 0.14.0-r2 —
Wolfi rolling external-dns-0.21 0.21.0-r16 —
Wolfi rolling falco-no-driver 0.44.1-r5 —
Wolfi rolling flux-2.7 2.7.5-r28 —
Wolfi rolling flux-2.8 2.8.8-r12 —
Wolfi rolling flux-2.9 2.9.4-r2 —
Wolfi rolling flux-image-automation-controller 1.2.4-r2 —
Wolfi rolling flux-image-reflector-controller 1.2.4-r1 —
Wolfi rolling flux-kustomize-controller 1.9.4-r2 —
Wolfi rolling flux-kustomize-controller-iamguarded-compat 1.9.5-r2 —
Wolfi rolling flux-notification-controller 1.9.3-r2 —
Wolfi rolling flux-source-controller 1.9.4-r1 —
Wolfi rolling fscrypt 0.3.6-r12 —
Wolfi rolling fuse-overlayfs-snapshotter 2.1.7-r20 —
Wolfi rolling gh 2.97.0-r1 —
Wolfi rolling gitlab-kas-19.2 +1 19.2.2-r1 —
Wolfi rolling golangci-lint 2.12.2-r6 —
Wolfi rolling grafana-alloy 1.18.1-r1 —
Wolfi rolling grafana-image-renderer 5.12.1-r1 —
Wolfi rolling grafana-rollout-operator 0.38.1-r3 —
Wolfi rolling grype 0.117.0-r1 —
Wolfi rolling helm-3 3.21.3-r1 —
Wolfi rolling helm-operator 1.42.3-r8 —
Wolfi rolling hubble 1.19.4-r8 —
Wolfi rolling infinispan-operator 2.5.14-r1 —
Wolfi rolling istioctl-1.29 +4 1.29.6-r2 —
Wolfi rolling k3d 5.9.0-r4 —
Wolfi rolling k3s +2 1.36.2.1-r5 —
Wolfi rolling k3s-1.32 +2 1.32.13.1-r26 —
Wolfi rolling k3s-1.34 +2 1.34.9.1-r4 —
Wolfi rolling k3s-1.35 +2 1.35.6.1-r4 —
Wolfi rolling k6 2.2.0-r1 —
Wolfi rolling kaf 0.2.14-r8 —
Wolfi rolling kine 0.16.3-r4 —
Wolfi rolling kitty 0.48.2-r1 —
Wolfi rolling ko 0.19.1-r3 —
Wolfi rolling krane 0.21.9-r1 —
Wolfi rolling kube-fluentd-operator 1.18.2-r75 —
Wolfi rolling kube-rbac-proxy 0.22.1-r5 —
Wolfi rolling kubeadm-1.34 +7 1.34.10-r2 —
Wolfi rolling kubeadm-1.35 +7 1.35.7-r2 —
Wolfi rolling kubeadm-1.36 +7 1.36.3-r1 —
Wolfi rolling kubectl-1.32 +4 No fix yet —
Wolfi rolling kubectl-1.33 1.33.13-r3 —
Wolfi rolling kubectl-bash-completion-1.35 +3 1.35.8-r6 —
Wolfi rolling kubernetes-dashboard 7.14.0-r12 —
Wolfi rolling kubo 0.42.0-r5 —
Wolfi rolling kubo-compat 0.43.1-r0 —
Wolfi rolling kustomize 5.8.1-r11 —
Wolfi rolling kyverno-1.17 1.17.2-r35 —
Wolfi rolling kyverno-1.18 +6 1.18.2-r7 —
Wolfi rolling kyverno-cli-1.17 +5 1.17.2-r22 —
Wolfi rolling kyverno-policy-reporter 3.9.1-r1 —
Wolfi rolling loki-3.6 +3 3.6.13-r0 —
Wolfi rolling loki-3.7 +2 3.7.3-r3 —
Wolfi rolling melange 0.59.0-r0 —
Wolfi rolling metrics-server 0.9.0-r4 —
Wolfi rolling metrics-server-compat 0.9.0-r11 —
Wolfi rolling minio 0.20260717.120751-r2 —
Wolfi rolling mps-control-daemon +2 0.19.3-r6 —
Wolfi rolling nsc 2.15.0-r5 —
Wolfi rolling opentelemetry-collector 0.157.0-r2 —
Wolfi rolling pg_timetable 7.0.0-r3 —
Wolfi rolling pg_user 1.1.1-r18 —
Wolfi rolling pgpool2_exporter 1.2.2-r27 —
Wolfi rolling podman-6.0 6.0.2-r2 —
Wolfi rolling prometheus-operator +2 0.93.1-r1 —
Wolfi rolling prometheus-operator-iamguarded-compat 0.94.0-r0 —
Wolfi rolling pulumi-language-java 1.36.0-r1 —
Wolfi rolling pulumi-language-yaml 1.38.2-r1 —
Wolfi rolling rabbitmq-messaging-topology-operator 1.20.1-r1 —
Wolfi rolling rabbitmq-messaging-topology-operator-iamguarded-compat 1.20.3-r1 —
Wolfi rolling rancher-2.14 +1 2.14.4-r1 —
Wolfi rolling rancher-agent-2.13 2.13.8-r1 —
Wolfi rolling rancher-fleet 0.16.1-r3 —
Wolfi rolling rancher-fleet-cli +2 0.16.0-r2 —
Wolfi rolling ratify +2 1.4.4-r1 —
Wolfi rolling rekor-cli 1.5.3-r4 —
Wolfi rolling renovate 44.115.4-r0 —
Wolfi rolling rqlite 10.2.7-r3 —
Wolfi rolling ruby3.3-fluent-plugin-grafana-loki-3.7 3.7.7-r4 —
Wolfi rolling runc 1.5.1-r1 —
Wolfi rolling runc-1.4 1.4.3-r1 —
Wolfi rolling seaweedfs 4.41-r1 —
Wolfi rolling sftpgo 2.7.5-r4 —
Wolfi rolling sftpgo-plugin-auth 1.0.16-r4 —
Wolfi rolling sftpgo-plugin-eventsearch 1.0.24-r4 —
Wolfi rolling sftpgo-plugin-geoipfilter 1.0.14-r3 —
Wolfi rolling sftpgo-plugin-pubsub 1.0.18-r3 —
Wolfi rolling snyk-cli 1.1306.2-r1 —
Wolfi rolling speedtest-go 1.7.11-r1 —
Wolfi rolling spicedb-operator 1.26.0-r3 —
Wolfi rolling spire-agent +2 1.15.2-r5 —
Wolfi rolling splunk-otel-collector +1 0.158.0-r1 —
Wolfi rolling splunk-otel-collector-compat 0.160.0-r0 —
Wolfi rolling sql_exporter 0.24.5-r1 —
Wolfi rolling step-issuer 0.12.0-r6 —
Wolfi rolling step-issuer-compat 0.12.0-r12 —
Wolfi rolling syft 1.51.0-r1 —
Wolfi rolling tailscale +1 1.98.9-r1 —
Wolfi rolling task 3.52.0-r4 —
Wolfi rolling tekton-chains 0.29.1-r1 —
Wolfi rolling telegraf-1.38 1.38.4-r12 —
Wolfi rolling terraform-provider-azapi 2.12.0-r1 —
Wolfi rolling terraform-provider-azurerm 5.1.0-r1 —
Wolfi rolling terraform-provider-google 7.44.0-r1 —
Wolfi rolling terragrunt 1.1.3-r1 —
Wolfi rolling timestamp-authority-server 2.1.3-r5 —
Wolfi rolling timoni 0.31.0-r1 —
Wolfi rolling trino 483-r2 —
Wolfi rolling trino-plugin-oracle +3 483-r7 —
Wolfi rolling vendir 0.46.0-r3 —
Wolfi rolling vexctl 0.4.4-r4 —
Wolfi rolling victoriametrics-operator 0.73.1-r4 —
Wolfi rolling victoriametrics-vmalert 1.149.0-r1 —
Wolfi rolling victoriametrics-vmalert-cluster 1.149.0-r2 —
Wolfi rolling zarf 0.83.0-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go golang.org/x/net < 0.56.0 0.56.0 GO-2026-5942
Go stdlib >= 1.26.0-0, < 1.26.6 · >= 1.27.0-0, < 1.27.0-rc.3 1.26.6, 1.27.0-rc.3 GO-2026-5942

Advisories 15

References