Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-46600 · Microsoft / collected KEV context

EUVD-2026-46383

GHSA-gg3m-vvp2-p2c5

GO-2026-5942

BIT-golang-2026-46600

cve-program · CVE-2026-46600

• https://go.dev/cl/786345
• https://go.dev/issue/79795
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-5942

euvd · EUVD-2026-46383

• https://go.dev/cl/786345
• https://go.dev/issue/79795
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-5942

nvd · CVE-2026-46600

• https://go.dev/cl/786345
• https://go.dev/issue/79795
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-5942

osv · GO-2026-5942

• https://go.dev/cl/786345
• https://go.dev/issue/79795
• https://groups.google.com/g/golang-announce/c/94pEornpRlI

• Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. · Advisory content revised · 30 Oct 2026