What is the CVSS score of CVE-2026-46600?

CVE-2026-46600 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of golang.org/x/net are affected by CVE-2026-46600?

The Go dns/dnsmessage library (golang.org/x/net) contains a denial-of-service vulnerability affecting applications that parse DNS responses, allowing remote attackers to crash services through…. A patch is available.

Is there a public PoC exploit available for CVE-2026-46600?

Yes, a public proof-of-concept exploit is available for CVE-2026-46600. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-46600?

Within 24 hours, identify and inventory all internal applications and services using golang.org/x/net library versions prior to the patched release, prioritizing DNS-facing services, resolvers, and proxies. Within 7 days, apply the vendor-released patch to golang.org/x/net across all affected applications and redeploy to production. Within 30 days, verify patch deployment across all systems, establish a baseline Go module inventory, and implement quarterly dependency update reviews to catch future golang.org/x/net releases.

golang.org/x/net CVE-2026-46600

EUVD-2026-46383 HIGH

Out-of-bounds Read (CWE-125)

2026-07-21 Go

GHSA-gg3m-vvp2-p2c5

Buffer Overflow Information Disclosure Red Hat Golang Org X Net Dns Dnsmessage Golang Org X Net

7.5

CVSS 3.1 · Vendor: Go

Severity by source

Vendor (Go) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote parsing of untrusted DNS records needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); a panic yields availability loss only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (Go).

CVSS VectorVendor: Go

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:07 vuln.today

CVSS changed

Jul 23, 2026 - 16:22 NVD

7.5 (HIGH)

Patch available

Jul 21, 2026 - 21:18 EUVD

CVE Published

Jul 21, 2026 - 19:18 cve.org

HIGH 7.5

CVE Published

Jul 21, 2026 - 19:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

AnalysisAI

Denial of service in the Go golang.org/x/net/dns/dnsmessage package allows remote attackers to crash any application that parses attacker-supplied DNS responses by sending a malformed SVCB or HTTPS resource record. When the declared size of a service-parameter value exceeds the remaining DNS message buffer, the parser panics instead of returning an error, taking down the DNS client, resolver, or proxy embedding this library. EPSS is low (0.15%) and there is no public exploit identified at time of analysis, but a vendor patch is available and the pre-conditions are trivial for any host that resolves DNS through untrusted responders.

Technical ContextAI

The affected component is dnsmessage, the low-level DNS wire-format parser in Go's supplementary networking module golang.org/x/net (CPE cpe:2.3:a:golang.org/x/net:golang.org/x/net/dns/dnsmessage). SVCB (type 64) and HTTPS (type 65) resource records carry a list of length-prefixed SvcParam key/value pairs; the parser reads a declared value length and then attempts to consume that many bytes from the message. The root cause is CWE-125 (out-of-bounds read): when the declared parameter length overflows past the end of the message buffer, bounds arithmetic is not validated before the slice access, producing an out-of-range index that triggers a Go runtime panic. Because Go panics unwind the goroutine and, if unrecovered, terminate the process, an untrusted RR can convert a parsing error into a crash.

RemediationAI

Vendor-released patch: upgrade golang.org/x/net to version 0.56.0 or later (run 'go get golang.org/x/net@v0.56.0' and rebuild all affected binaries), which is the primary and complete fix per GO-2026-5942 and go.dev/cl/786345. Because the flaw lives in a statically compiled dependency, every application that vendors golang.org/x/net must be individually rebuilt and redeployed - there is no runtime shim. Where an immediate rebuild is not possible, compensating controls include forcing DNS resolution through a trusted, validating upstream resolver so applications do not parse RRs from arbitrary servers, and where feasible filtering or dropping SVCB (type 64) and HTTPS (type 65) records at a controlling resolver or DNS proxy - with the trade-off that this breaks HTTPS/SVCB-based service discovery and ECH. Applications that expose the parser to the network can also add recover() around the parsing goroutine as a stopgap so a panic degrades a single request rather than the whole process, but this masks rather than fixes the bug. See references https://pkg.go.dev/vuln/GO-2026-5942 and https://go.dev/issue/79795.

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2025-5777 CRITICAL POC

9.3

CVE-2016-1646 HIGH POC

8.8

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Module for Containers 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected

CVE-2026-46600 vulnerability details – vuln.today

Back

golang.org/x/net CVE-2026-46600

Severity by source

CVSS VectorVendor: Go

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-125 – Out-of-bounds Read

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code