CVE-2026-39836

What it actually does

This vulnerability affects Go applications built for Windows that call the net package Dial or LookupPort functions with input containing a NUL byte. If attacker-controlled input reaches one of these functions, the Go runtime can panic. When the panic is unhandled, the process can terminate, causing a denial of service. The impact is availability-only: the flaw does not directly provide code execution, data disclosure, or privilege escalation.

Why it matters to the business

Organizations running Windows-hosted services built with affected Go versions may experience application crashes if externally supplied host, address, network, or service-name values are passed to vulnerable networking functions. Internet-facing APIs, proxy services, agents, scanners, service-discovery components, and integrations that accept connection targets are most exposed. The CVSS score indicates high availability impact, but current exploitation signals are low: EPSS is approximately 0.006, unchanged over 30 days, and the issue is not listed in CISA KEV or known ransomware use. Because publication was 97 days ago, remediation should be planned and tracked, especially for Windows binaries in exposed service paths.

How an attack unfolds

An attacker identifies a Go-based application running on Windows that accepts a user-controlled value later used as a network address, host, port, or service name. The attacker submits a crafted value containing a NUL byte, commonly encoded in transit as %00 or represented internally as \x00. If the application passes that value to net.Dial or net.LookupPort without sanitization, the vulnerable function panics. If the application does not recover from the panic, the process exits or the worker crashes. Repeated requests can create sustained denial of service, trigger restart loops, exhaust operational capacity, or disrupt dependent workflows.

How to fix it

Upgrade the affected Go toolchain or runtime libraries to a version that includes the vendor fix, then rebuild and redeploy all Windows binaries. No exact fixed version was provided in the input, so teams should consult the official Go security release notes and package advisories for CVE-2026-39836 before closing remediation. As compensating controls, reject or normalize NUL bytes in all inputs that can influence hostnames, addresses, network names, ports, or service names before calling net.Dial, net.DialContext, net.LookupPort, or wrappers around them. Add defensive panic recovery at request/task boundaries so a single malformed input cannot terminate the entire process. Limit unauthenticated access to features that initiate outbound connections, add rate limiting, and ensure Windows services are supervised with safe restart policies while patching is underway.

How to confirm the fix worked

Confirm exposure by inventorying Windows binaries built with Go and identifying code paths that call net.Dial, net.DialContext, net.LookupPort, or libraries that wrap these calls using external input. Verify the deployed binary was rebuilt with a patched Go release once one is identified from official Go advisories. Add a regression test that supplies NUL-containing inputs, such as host\x00name or http://example.com%00, and confirm the application returns a controlled validation error instead of panicking or exiting. In production, validate that input validation rejects NUL bytes and that logs show handled errors rather than Go panic stack traces. For externally exposed services, perform a safe negative test in a controlled maintenance or staging environment before testing production endpoints.

Typical attack path

1. Find a Windows-hosted Go service or component that accepts externally supplied connection targets, hostnames, addresses, ports, or service names.
2. Submit crafted input containing a NUL byte, such as a value encoded as %00 in an HTTP parameter or request body.
3. Trigger application logic that passes the crafted value to Go net.Dial or net.LookupPort.
4. Cause the vulnerable function to panic.
5. Rely on the panic being unhandled so the process or worker terminates.
6. Repeat the request to maintain service disruption or cause restart-loop instability.

How to detect it

To determine whether exploitation already occurred, review application logs, reverse proxy logs, API gateway logs, Windows Event Logs, crash dumps, and service supervisor telemetry for correlated malformed inputs and process crashes. Focus on requests containing NUL-byte encodings such as %00, double-encoded %2500, or escaped \x00 near parameters representing hostnames, addresses, ports, service names, webhooks, callbacks, proxies, or connection targets. In application logs and crash artifacts, look for Go panic stack traces referencing net.Dial, net.DialContext, net.LookupPort, or related net package functions. In Windows telemetry, correlate Application Error events, service termination events, restart-loop messages, or crash dumps for Go-based processes with inbound requests carrying NUL encodings. Because the vulnerability is a denial-of-service condition, absence of file creation or persistence artifacts is expected; the strongest evidence is a time-aligned sequence of crafted input followed by a Go panic or process termination.

• %00
• %2500
• \x00
• \u0000
• panic:
• net.Dial
• net.DialContext
• net.LookupPort
• runtime error
• Application Error
• Faulting application name
• Service Control Manager
• service terminated unexpectedly

What your security team should do

• Prioritize inventory of Windows-hosted Go applications and agents, especially internet-facing services and components that accept user-supplied connection targets.
• Track the official Go advisory and upgrade to the fixed Go release as soon as available; rebuild and redeploy Windows binaries rather than only updating source dependencies.
• Immediately add input validation to reject NUL bytes in any hostname, address, port, service-name, proxy, webhook, callback URL, or service-discovery field.
• Search logs and crash telemetry for panic traces involving net.Dial or net.LookupPort and requests containing %00 or \x00.
• Add monitoring for unexpected process exits, Windows Application Error events, service restart loops, and crash dumps for Go services.
• Use rate limiting, authentication, and feature gating around functionality that causes the application to initiate outbound network connections.
• Create regression tests for NUL-containing network inputs and require them in CI for Windows builds.