CVE-2026-42503highCWE-1327

CVE-2026-42503: high-severity vulnerability in golang.org/x/tools/gopls

Accidental binding to INADDR_ANY might lead to RCE in golang.org/x/tools/gopls

Published · Updated

Follow this CVE+ Monitor golang.org/x/tools/gopls+ Monitor gopls

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.2%
In short

gopls (Go language server) can accidentally bind to all network interfaces (0.0.0.0) when using certain debug flags, allowing anyone on the network to execute arbitrary code on the affected machine.

Technical detail

When gopls is invoked with -listen or -port flags without an explicit hostname (e.g., :8080), it defaults to binding 0.0.0.0 instead of localhost, creating an unauthenticated RPC endpoint accessible to the local network. An attacker on the same network can send malicious requests to this exposed endpoint to achieve remote code execution with the privileges of the gopls process.

Summary generated and translated by AI from the official description.
gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.  As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
golang.org/x/tools · golang.org/x/tools/gopls