CVE-2026-42503 - Vulnerability Analysis

Overview

gopls contains a remote code execution vulnerability caused by binding to 0.0.0.0 when using -port or -listen flags without explicit host, letting attackers on the same network execute arbitrary code remotely, exploit requires network access.

Severity & Score

Impact

Attackers on the same network can execute arbitrary code remotely via gopls binding to all interfaces.

Mitigation

Avoid using -port or -listen flags without specifying an explicit host or update to the latest version with a fix.

References

• https://go.dev/cl/774381
• https://go.dev/issue/79211

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner