CVE-2026-46600 json
Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
published 2026-07-14 3 mo ago modified 2026-10-24 15 d ago also BIT-golang-2026-46600 , EUVD-2026-46383 , GO-2026-5942
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
Patch / fix
- bitnami golang 1.26.6
- go stdlib 1.26.6, 1.27.0-rc.3
- go golang.org/x/net 0.56.0
- Go standard library net 1.26.6, 1.27.0-rc.3
- golang.org/x/net golang.org/x/net/dns/dnsmessage 0.56.0
- golang-golang-x-net Debian 14 1:0.56.0-1
debian advisories DEBIAN-CVE-2026-46600
- alloy SLES for SAP applications 16.0, SLES 16.0 1.19.2-160000.1.1
- alloy SLE Module for Basesystem 15 SP7 1.19.2-150700.15.29.1
- govulncheck-vulndb SLES for SAP applications 16.0, SLES 16.0 0.0.20260827T195228-160000.1.1
- kubevirt-1.6 SLE Module for Containers 15 SP7 1.6.6-150700.15.17.1
- kubevirt SLE Module for Containers 15 SP7 1.7.4-150700.3.33.1
suse advisories SUSE-SU-2026:24148-1SUSE-SU-2026:4408-1SUSE-SU-2026:23625-1SUSE-SU-2026:3630-1SUSE-SU-2026:3480-1
- flannel openSUSE Tumbleweed 0.28.10-1.1
- alloy openSUSE Leap 16.0 1.19.2-160000.1.1
- rclone openSUSE Leap 16.0 1.75.1-bp160.1.1
- alloy openSUSE Tumbleweed 1.19.2-1.1
- rclone openSUSE Tumbleweed 1.75.1-1.1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260827T195228-160000.1.1
- kubevirt1.8 openSUSE Leap 16.0 1.8.4-160000.1.1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:12270-1openSUSE-SU-2026:22032-1openSUSE-SU-2026:21999-1openSUSE-SU-2026:11803-1openSUSE-SU-2026:11727-1openSUSE-SU-2026:21761-1
- go Alpine 3.24 1.26.8-r0
alpine advisories ALPINE-CVE-2026-46600
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- go.dev/cl/786345 patch
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-46600 updated cvss 7.5
golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
-
Red Hat ExternalDNS Operator edo/external-dns-rhel9, edo/external-dns-rhel9-operator Red Hat File Integrity Operator compliance/openshift-file-integrity-rhel8-operator Red Hat Multicluster Engine for Kubernetes multicluster-engine/work-rhel9, multicluster-engine/placement-rhel9, multicluster-engine/registration-rhel9, multicluster-engine/addon-manager-rhel9, multicluster-engine/capoa-bootstrap-rhel9, multicluster-engine/assisted-installer-rhel9, +16 more Red Hat OpenShift Pipelines openshift-pipelines/pipelines-cli-tkn-rhel9, openshift-pipelines/pipelines-rhel9-operator, openshift-pipelines/pipelines-results-api-rhel9, openshift-pipelines/pipelines-operator-proxy-rhel9, openshift-pipelines/pipelines-results-watcher-rhel9, openshift-pipelines/pipelines-operator-webhook-rhel9, +8 moreaffected: no fix available
-
Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/volsync-rhel9, rhacm2/acm-volsync-addon-controller-rhel9affected: no fix available, no fix planned “Will not fix”
-
Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-scanner-v4-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-maas-controller-rhel9, rhoai/odh-mlflow-operator-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, +12 more Red Hat OpenShift Container Platform 4 openshift-golang-builder-container Red Hat OpenShift Container Platform 5 openshift5/ose-thanos-rhel9, openshift-golang-builder-container, openshift5/ose-kube-rbac-proxy-rhel9affected: no fix available
-
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080fixed: vendor fix RHSA-2026:82322
-
Red Hat Cert Manager support for Red Hat OpenShift release 1.19 cert-manager/cert-manager-operator-rhel9 1788348522, cert-manager/jetstack-cert-manager-rhel9 1788348571, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1788348571fixed: vendor fix RHSA-2026:63135
-
Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/cert-manager-operator-rhel9 1790272426, cert-manager/cert-manager-operator-rhel9 1790589855, cert-manager/jetstack-cert-manager-rhel9 1790223279, cert-manager/jetstack-cert-manager-rhel9 1790589912, cert-manager/cert-manager-istio-csr-rhel9 1790223719, cert-manager/cert-manager-istio-csr-rhel9 1790589914, +1 morefixed: vendor fix RHSA-2026:72475
-
Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/thanos-rhel9 1787594087, cluster-observability-operator/perses-rhel9-operator 1787593697, cluster-observability-operator/cluster-observability-rhel9-operator 1787593637fixed: vendor fix RHSA-2026:61314
-
Red Hat Logging Subsystem for Red Hat OpenShift 6.0 openshift-logging/cluster-logging-rhel9-operator 1791830134fixed: vendor fix RHSA-2026:83013
show 19 moreshow fewer
-
Red Hat Logging Subsystem for Red Hat OpenShift 6.5 openshift-logging/cluster-logging-rhel9-operator 1789659166fixed: vendor fix RHSA-2026:70870
-
Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine/hive-rhel9 1790230875, multicluster-engine/kube-rbac-proxy-mce-rhel9 1790128238fixed: vendor fix RHSA-2026:72853
-
Red Hat OpenShift Compliance Operator 1 compliance/openshift-compliance-rhel8-operator 1789144478fixed: vendor fix RHSA-2026:67707
-
Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2/insights-client-rhel9 1787688993, rhacm2/insights-metrics-rhel9 1787681737fixed: vendor fix RHSA-2026:60387
-
Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/insights-client-rhel9 1787259125, rhacm2/insights-metrics-rhel9 1787259092fixed: vendor fix RHSA-2026:60390
-
Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/insights-client-rhel9 1786882244, rhacm2/insights-metrics-rhel9 1786646569fixed: vendor fix RHSA-2026:60388
-
Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2/acm-grafana-rhel9 1790187562, rhacm2/insights-client-rhel9 1787238585, rhacm2/kube-rbac-proxy-rhel9 1790186510, rhacm2/insights-metrics-rhel9 1787238556, rhacm2/mtv-integrations-rhel9 1790182395, rhacm2/thanos-receive-controller-rhel9 1790189581, +4 morefixed: vendor fix RHSA-2026:72884
-
Red Hat Advanced Cluster Management for Kubernetes 2.16 rhacm2/insights-client-rhel9 1787184541, rhacm2/insights-metrics-rhel9 1787086830, rhacm2/mtv-integrations-rhel9 1790198248fixed: vendor fix RHSA-2026:60391
-
Red Hat Advanced Cluster Management for Kubernetes 2.17 rhacm2/insights-client-rhel9 1787227689, rhacm2/insights-metrics-rhel9 1787227665, rhacm2/mtv-integrations-rhel9 1790202080fixed: vendor fix RHSA-2026:60386
-
Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-scanner-slim-rhel9 1789068649fixed: vendor fix RHSA-2026:67714
-
Red Hat OpenShift Builds 1.8.3 openshift-builds/openshift-builds-shared-resource-rhel9 1792680568, openshift-builds/openshift-builds-shared-resource-rhel9 1792837466, openshift-builds/openshift-builds-shared-resource-webhook-rhel9 1792680570, openshift-builds/openshift-builds-shared-resource-webhook-rhel9 1792838794fixed: fixed in 1.8.3 RHSA-2026:89031
-
Red Hat OpenShift Builds 1.9.2 openshift-builds/openshift-builds-operator-bundle 1792762900, openshift-builds/openshift-builds-rhel10-operator 1792749358, openshift-builds/openshift-builds-rhel10-operator 1792859629, openshift-builds/openshift-builds-shared-resource-rhel10 1792680549, openshift-builds/openshift-builds-shared-resource-rhel10 1792857112, openshift-builds/openshift-builds-shared-resource-webhook-rhel10 1792680546, +1 morefixed: fixed in 1.9.2 RHSA-2026:89041
-
Red Hat OpenShift distributed tracing 3.10.1 rhosdt/opentelemetry-rhel9-operator 1786635175fixed: vendor fix RHSA-2026:54773
-
Red Hat OpenShift distributed tracing 3.11 rhosdt/opentelemetry-rhel9-operator 1789646504, rhosdt/opentelemetry-collector-rhel9 1789646503fixed: vendor fix RHSA-2026:69268
-
Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/jetstack-cert-manager-acmesolver-rhel9 1790223630 Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1787593946, cluster-observability-operator/korrel8r-rhel9 1787593952, cluster-observability-operator/prometheus-rhel9 1787593705, cluster-observability-operator/alertmanager-rhel9 1787593799, cluster-observability-operator/logging-console-plugin-rhel9 1787593634, cluster-observability-operator/cluster-health-analyzer-rhel9 1787594138, +16 morenot affected: vulnerable code not present
-
Red Hat File Integrity Operator compliance/openshift-compliance-rhel8-operatornot affected: component not present
-
Red Hat Logging Subsystem for Red Hat OpenShift 6.0 openshift-logging/vector-rhel9 1791777198, openshift-logging/eventrouter-rhel9 1791500947, openshift-logging/logging-loki-rhel9 1791500729, openshift-logging/loki-rhel9-operator 1791499216, openshift-logging/opa-openshift-rhel9 1791500883, openshift-logging/loki-operator-bundle 1791504713, +3 more Red Hat Logging Subsystem for Red Hat OpenShift 6.5 openshift-logging/vector-rhel9 1789659541, openshift-logging/eventrouter-rhel9 1789659145, openshift-logging/logging-loki-rhel9 1789736915, openshift-logging/loki-rhel9-operator 1789736807, openshift-logging/opa-openshift-rhel9 1789659129, openshift-logging/loki-operator-bundle 1789737942, +3 more Red Hat Multicluster Engine for Kubernetes multicluster-engine/discovery-rhel9, multicluster-engine/backplane-rhel9-operator, multicluster-engine/mce-capi-webhook-config-rhel9, multicluster-engine/cluster-api-provider-aws-rhel9, multicluster-engine/cluster-api-provider-kubevirt-rhel9 Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine/work-rhel9 1790196178, multicluster-engine/discovery-rhel9 1790134510, multicluster-engine/placement-rhel9 1790197062, multicluster-engine/console-mce-rhel9 1790135546, multicluster-engine/must-gather-rhel9 1790128849, multicluster-engine/registration-rhel9 1790197531, +23 more Red Hat OpenShift Compliance Operator 1 compliance/openshift-compliance-content-rhel8 1789150550, compliance/openshift-compliance-openscap-rhel8 1789152963, compliance/openshift-compliance-operator-bundle 1789154836, compliance/openshift-compliance-must-gather-rhel8 1788942878not affected: vulnerable code not present
-
Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-must-gather-rhel9, rhacm2/submariner-addon-rhel9, rhacm2/acm-search-v2-api-rhel9, rhacm2/cert-policy-controller-rhel9, rhacm2/config-policy-controller-rhel9, rhacm2/governance-policy-propagator-rhel9, +4 morenot affected: vulnerable code cannot be controlled by adversary
-
Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2/thanos-rhel9 1787685239, rhacm2/console-rhel9 1787687062, rhacm2/prometheus-rhel9 1787261499, rhacm2/acm-grafana-rhel9 1787682482, rhacm2/acm-search-v2-rhel9 1787688827, rhacm2/node-exporter-rhel9 1787263326, +33 more Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/thanos-rhel9 1787263906, rhacm2/acm-cli-rhel9 1787259085, rhacm2/console-rhel9 1787339249, rhacm2/prometheus-rhel9 1787263757, rhacm2/acm-grafana-rhel9 1787644958, rhacm2/acm-search-v2-rhel9 1787682112, +36 more Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/thanos-rhel9 1787614805, rhacm2/acm-cli-rhel9 1786923505, rhacm2/console-rhel9 1787339248, rhacm2/prometheus-rhel9 1786976997, rhacm2/acm-grafana-rhel9 1787645355, rhacm2/acm-search-v2-rhel9 1787682033, +36 morenot affected: vulnerable code not present
12 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | golang | >=1.26.0, <1.26.6 |
1.26.6 |
| go | stdlib | >=1.26.0-0, <1.26.6 >=1.27.0-0, <1.27.0-rc.3 |
1.26.6 1.27.0-rc.3 |
| go | golang.org/x/net | <0.56.0 |
0.56.0 |
Affected products
- Go standard library net
- golang.org/x/net golang.org/x/net/dns/dnsmessage
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
References
-
go.dev
/cl/786345
web, patch
-
go.dev
/issue/79795
web, report
-
groups.google.com
/g/golang-announce/c/94pEornpRlI
web
-
pkg.go.dev
/vuln/GO-2026-5942
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-46600
web
Sources
- CVE List CVE-2026-46600
- NVD CVE-2026-46600
- OSV BIT-golang-2026-46600
- OSV GO-2026-5942
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.