CVE-2026-42503
Accidental binding to INADDR_ANY might lead to RCE in golang.org/x/tools/gopls
In short
gopls (Go language server) can accidentally bind to all network interfaces (0.0.0.0) when using certain debug flags, allowing anyone on the network to execute arbitrary code on the affected machine.
Technical detail
When gopls is invoked with -listen or -port flags without an explicit hostname (e.g., :8080), it defaults to binding 0.0.0.0 instead of localhost, creating an unauthenticated RPC endpoint accessible to the local network. An attacker on the same network can send malicious requests to this exposed endpoint to achieve remote code execution with the privileges of the gopls process.
Summary generated and translated by AI from the official description.
gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.
If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.
As a result, users might inadvertently cause gopls to bind 0.0.0.0.
This can allow a malicious party on the same network to execute code arbitrarily via gopls.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
golang.org/x/tools · golang.org/x/tools/goplsWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →