Volerion logoVolerion
Volerion logoVolerion

Go Dial and LookupPort Functions NUL Byte Handling Panic Vulnerability on Windows

Vulnerability

A vulnerability exists in the Go programming language's standard library, specifically within the 'net' package. The issue arises in the 'Dial' and 'LookupPort' functions, which panic on Windows when they encounter an input containing a NUL byte. This behavior can lead to unexpected crashes in applications that rely on these functions.

Impact

Exploitation of this vulnerability causes a panic, leading to a crash of the application.

Remediation

Users can upgrade to Go versions 1.26.3 or 1.25.10, both of which address this vulnerability. Instructions for downloading these versions are available on the Go website.

Added: May 7, 2026, 8:46 PM
Updated: May 7, 2026, 8:46 PM

Vulnerability Rating

Custom Algorithm
spread
5.4
impact
2.5
exploitability
5.0
remediation
7.7
relevance
7.7
threat
3.2
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.