Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-39836: Windows Dial and LookupPort functions crash on invalid input
CVE-2026-39836 · published 6 months ago
Summary
The Dial and LookupPort functions in Windows may crash if given an input containing a special character. This can happen if an attacker sends a malicious request. To avoid this, you should ensure that any input to these functions is properly validated and sanitized.
What to do
- Update stdlib to version 1.26.3.
- Update golang to version 1.26.3.
- Update bellsoft go to version 1.26.3-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:25.10 | canonical | golang-1.25 | All versions |
| Ubuntu:14.04:LTS | canonical | golang-1.10 | All versions |
| Ubuntu:16.04:LTS | canonical | golang-1.10 | All versions |
| Ubuntu:16.04:LTS | canonical | golang-1.6 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | golang-1.13 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | golang-1.18 | All versions |
| Ubuntu:18.04:LTS | canonical | golang-1.10 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | golang-1.13 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | golang-1.16 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | golang-1.18 | All versions |
| Ubuntu:18.04:LTS | canonical | golang-1.8 | All versions |
| Ubuntu:18.04:LTS | canonical | golang-1.9 | All versions |
| Ubuntu:20.04:LTS | canonical | golang-1.13 | All versions |
| Ubuntu:20.04:LTS | canonical | golang-1.14 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | golang-1.16 | All versions |
| Ubuntu:20.04:LTS | canonical | golang-1.18 | All versions |
| Ubuntu:20.04:LTS | canonical | golang-1.20 | All versions |
| Ubuntu:20.04:LTS | canonical | golang-1.21 | All versions |
| Ubuntu:20.04:LTS | canonical | golang-1.22 | All versions |
| Ubuntu:22.04:LTS | canonical | golang-1.17 | All versions |
| Ubuntu:22.04:LTS | canonical | golang-1.18 | All versions |
| Ubuntu:22.04:LTS | canonical | golang-1.20 | All versions |
| Ubuntu:22.04:LTS | canonical | golang-1.21 | All versions |
| Ubuntu:22.04:LTS | canonical | golang-1.22 | All versions |
| Ubuntu:22.04:LTS | canonical | golang-1.23 | All versions |
| Ubuntu:22.04:LTS | canonical | golang-1.24 | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | golang-1.13 | All versions |
| Ubuntu:24.04:LTS | canonical | golang-1.21 | All versions |
| Ubuntu:24.04:LTS | canonical | golang-1.22 | All versions |
| Ubuntu:24.04:LTS | canonical | golang-1.23 | All versions |
| Ubuntu:24.04:LTS | canonical | golang-1.24 | All versions |
| Ubuntu:25.10 | canonical | golang-1.23 | All versions |
| Ubuntu:25.10 | canonical | golang-1.24 | All versions |
| Ubuntu:26.04:LTS | canonical | golang-1.23 | All versions |
| Ubuntu:26.04:LTS | canonical | golang-1.24 | All versions |
| Ubuntu:26.04:LTS | canonical | golang-1.25 | All versions |
| Go | – | stdlib |
>= 1.26.0-0, < 1.26.3 Fix: upgrade to 1.26.3
|
| Bitnami | – | golang |
>= 1.26.0-0, < 1.26.3 Fix: upgrade to 1.26.3
|
| – | golang | go |
< 1.25.10 >= 1.26.0, < 1.26.3 cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* |
| Alpaquita:stream | bellsoft | go |
>= 1.20.5-r2, < 1.26.3-r0 Fix: upgrade to 1.26.3-r0
|
| BellSoft Hardened Containers:stream | bellsoft | go |
>= 1.20.5-r2, < 1.26.3-r0 Fix: upgrade to 1.26.3-r0
|
Original advisory text
Panic in Dial and LookupPort when handling NUL byte on Windows in net
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
References
- https://docs.bell-sw.com/security/cves/CVE-2026-39836 Vendor Advisory
- https://go.dev/cl/775320 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-39836 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-39836 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-39836 Third Party Advisory
- https://go-review.googlesource.com/c/go/+/775320 Third Party Advisory
- https://github.com/golang/go/issue/79006 Third Party Advisory
- https://go.dev/issue/79006 URL
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M URL
- https://pkg.go.dev URL
- https://pkg.go.dev/vuln/GO-2026-4971 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39836... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-476NULL Pointer Dereference
Timeline
Published7 May 2026
Updated4 Nov 2026
First seen7 May 2026
Sources
UBUNTU-CVE-2026-39836 · OSV
CVE-2026-39836 · NVD
GO-2026-4971 · OSV
BIT-golang-2026-39836 · OSV
BELL-CVE-2026-39836 · OSV
CVE-2026-39836 · OSV
Track software like this
Free during beta