VULNERABILITY INTELLIGENCE

CVE-2026-42503

CVSS score8.8 HIGH
EPSS probability0.21%
CISA KEVNot currently listed
Published2026-05-06
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.  As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.

Weakness classification

  • security@golang.org: CWE-1327

Primary references