Repository navigation
net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record #79795
Description
Parsing an invalid SVCB or HTTPS RR can panic when
the size of a parameter value overflows the message buffer.
Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
This is CVE-2026-46600 and Go issue https://go.dev/issue/79795.
This was a PUBLIC track issue, tracked in http://b/517101980.
Activity
gopherbot commentedon Jun 2, 2026
Change https://go.dev/cl/786345 mentions this issue:
dns/dnsmessage: avoid panic when parsing SVCB record with truncated datadns/dnsmessage: avoid panic when parsing SVCB record with truncated data
Bobi-Wan commentedon Jul 14, 2026
Hi! Has this been patched/backported? I don't seem to be able to track further than the mentioned commit above.
nicholashusin commentedon Jul 28, 2026
@gopherbot Please open backport for this security issue.
gopherbot commentedon Jul 28, 2026
Backport issue(s) opened:
#80608 (for 1.25),#80609 (for 1.26).Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
cherrymui commentedon Jul 28, 2026
Reopen to have it vendored to Go 1.27
mateusz834 commentedon Jul 29, 2026
I don't think we use this in the main Go repo, not sure if we need to vendor+backport this.
nicholashusin commentedon Jul 29, 2026
Unfortunately, I think the vulnerable symbol is transitively reachable when using the CGO
net.Resolver(pure Go resolver doesn't use it though).mateusz834 commentedon Jul 29, 2026
Ohh, right since
LookupCNAMEusesp.AllAnswers()(which is bad), so if someone would return a SVCB record with CNAME query it could trigger that.gopherbot commentedon Jul 31, 2026
Change https://go.dev/cl/808620 mentions this issue:
[internal-branch.go1.26-vendor] dns/dnsmessage: avoid panic when parsing SVCB record with truncated datagopherbot commentedon Jul 31, 2026
Change https://go.dev/cl/808640 mentions this issue:
[internal-branch.go1.25-vendor dns/dnsmessage: avoid panic when parsing SVCB record with truncated datagopherbot commentedon Jul 31, 2026
Change https://go.dev/cl/808621 mentions this issue:
[internal-branch.go1.27-vendor] dns/dnsmessage: avoid panic when parsing SVCB record with truncated data[internal-branch.go1.27-vendor] dns/dnsmessage: avoid panic when pars…
[internal-branch.go1.26-vendor] dns/dnsmessage: avoid panic when pars…
gopherbot commentedon Jul 31, 2026
Change https://go.dev/cl/808660 mentions this issue:
[release-branch.go1.27] all: update x/netgopherbot commentedon Jul 31, 2026
Change https://go.dev/cl/808680 mentions this issue:
[release-branch.go1.26] all: update x/net[release-branch.go1.27] all: update x/net
[release-branch.go1.26] all: update x/net
gopherbot commentedon Jul 31, 2026
Closed by merging CL 808660 (commit c498b9f) to
release-branch.go1.27.[-]x/net/dns/dnsmessage: panic when parsing invalid SVCB record[/-][+]net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record[/+]kagof commentedon Aug 14, 2026
This doesn't appear to have been backported to the 1.25 release channel.
The vuln report https://pkg.go.dev/vuln/GO-2026-5942 says it affects version "before go1.26.6", however the backport cherry-pick #80608 was closed because it does not apply to Go 1.25:
I might not be raising this in the correct place, and apologies if that is the case. But is it possible to update the vulnerability report to reflect that it only affects Go versions (≥1.26.0 and < 1.26.6), and (≥go1.27.0-0 and < go1.27.0-rc3), rather than anything <1.26.6?
EDIT: I've found the vuln db repo and raised a request to modify the report there golang/vulndb#6226