CVE-2026-39836 The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

Description

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

Affected products and versions

Product	Affected versions	Fixed in
net 1.26	1.26.0-0 → < 1.26.3	1.26.3
net 1.25	earliest → < 1.25.10	1.25.10

Other CVEs of net

The 4 CVEs of net →

CVE-2026-46600 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer 7.5 High CVE-2026-33811 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a… 7.5 High CVE-2024-24788 A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop 5.9 Medium