CVE-2026-39836

A flaw was found in the net package of Go (golang). When running on Windows, the Dial and LookupPort functions can panic if they receive an input containing a NUL (0) byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service (DoS) for applications using these functions.

This denial of service flaw exists within the Go net package, specifically impacting applications when executed on Microsoft Windows operating systems. Red Hat Product Security has rated this flaw as a Moderate as Red Hat products primarily deploy Go applications on Linux-based environments. Customers operating Go applications, including those bundled with Red Hat products, within a Windows environment should assess their exposure to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.