CVE-2026-42503

HighCVSS 8.8/10Last modified Oct 26, 2026

Description

gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.  As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1327

Affected software

VendorProductVersions
golang.org/x/toolsgolang.org/x/tools/gopls>= 0.0.0, < 0.22.0

References

Timeline

Published
May 6, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-425047.5Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.CVE-2026-425055.3Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key idenCVE-2026-425066.1Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacCVE-2026-425075.3When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to CVE-2026-425089.1Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' CVE-2026-425096.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects ApaCVE-2026-42512.5A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of tCVE-2026-425107.2OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.CVE-2026-425118.1The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf dirCVE-2026-425128.1As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expanCVE-2026-425138.8This vulnerability exists in e-Sushrut due to improper authentication logic that relies on client-side response parameters to determine authCVE-2026-425148.8This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulne