Repository navigation
net: panic in Dial and LookupPort when handling NUL byte on Windows (fix CVE-2026-39836) #79006
Description
Activity
Hi @gopherbot, please open backport issues for this security issue.
Backport issue(s) opened: #79028 (for 1.25), #79029 (for 1.26).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
Change https://go.dev/cl/775160 mentions this issue:
[release-branch.go1.25] all: avoid unsafe StringToUTF16Ptr on WindowsChange https://go.dev/cl/775162 mentions this issue:
[release-branch.go1.26] all: avoid unsafe StringToUTF16Ptr on Windows- changed the title
[-]security: fix CVE-2026-39836[/-][+]net: panic in Dial and LookupPort when handling NUL byte on Windows (fix CVE-2026-39836)[/+]on May 7, 2026 Change https://go.dev/cl/775320 mentions this issue:
all: avoid unsafe StringToUTF16Ptr on Windows- added a commit that references this issue
on May 7, 2026
The Dial and LookupPort functions would panic on Windows when provided
with an input containing a NUL (0). These functions now return an error
rather than panicking.
This is CVE-2026-39836 and Go issue https://go.dev/issue/79006.
This was a PRIVATE track issue, tracked in http://b/502138517.