Panic in Dial and LookupPort when handling NUL byte on Windows in net

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-39836 · Microsoft / collected KEV context

EUVD-2026-28427

GO-2026-4971

BIT-golang-2026-39836

cve-program · CVE-2026-39836

• https://go.dev/issue/79006
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://go.dev/cl/775320
• https://pkg.go.dev/vuln/GO-2026-4971

euvd · EUVD-2026-28427

• https://go.dev/issue/79006
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://go.dev/cl/775320
• https://pkg.go.dev/vuln/GO-2026-4971

nvd · CVE-2026-39836

• https://go.dev/cl/775320
• https://go.dev/issue/79006
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://pkg.go.dev/vuln/GO-2026-4971

osv · GO-2026-4971

• https://go.dev/issue/79006
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://go.dev/cl/775320

• The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). · Advisory content revised · 1 Nov 2026