{"id":"CVE-2026-46600","revision":"d3c992b099dd4dc8ab6bfa2f007b68b6","records":[{"revision":"d3c992b099dd4dc8ab6bfa2f007b68b6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-46600","aliases":[],"title":"Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage","description":"Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.","state":0,"publishedAt":"2026-07-21T19:18:59.755+00:00","modifiedAt":"2026-08-14T15:46:12.894+00:00","affected":[{"ecosystem":"https://pkg.go.dev","name":"net","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Go standard library\",\n                    \"product\": \"net\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"net\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.26.0-0\",\n                            \"lessThan\": \"1.26.6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"1.27.0-0\",\n                            \"lessThan\": \"1.27.0-rc.3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"cgoResSearch\"\n                        },\n                        {\n                            \"name\": \"LookupCNAME\"\n                        },\n                        {\n                            \"name\": \"Resolver.LookupCNAME\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://pkg.go.dev","name":"golang.org/x/net/dns/dnsmessage","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"golang.org/x/net\",\n                    \"product\": \"golang.org/x/net/dns/dnsmessage\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"golang.org/x/net/dns/dnsmessage\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"0.56.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"unpackSVCBResource\"\n                        },\n                        {\n                            \"name\": \"Message.Unpack\"\n                        },\n                        {\n                            \"name\": \"Parser.Additional\"\n                        },\n                        {\n                            \"name\": \"Parser.AllAdditionals\"\n                        },\n                        {\n                            \"name\": \"Parser.AllAnswers\"\n                        },\n                        {\n                            \"name\": \"Parser.AllAuthorities\"\n                        },\n                        {\n                            \"name\": \"Parser.Answer\"\n                        },\n                        {\n                            \"name\": \"Parser.Authority\"\n                        },\n                        {\n                            \"name\": \"Parser.HTTPSResource\"\n                        },\n                        {\n                            \"name\": \"Parser.SVCBResource\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://go.dev/cl/786345","https://go.dev/issue/79795","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-5942"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46600","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-46600","identifiers":["CVE-2026-46600"]},"retained":false,"historicalAffected":[]}],"coverage":[]}