CVE-2026-42503
High · 8.8CVSS
8.8
EPSS
0.3%
Published
May 6, 2026
CISA due date
—
The record
gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-75021 fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the… CWE-1327
- CVE-2026-20212 A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could… CWE-1327
- CVE-2026-72924 GitHub CLI (gh) is GitHub's official command line tool. CWE-1327
- CVE-2026-16713 IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote… CWE-1327
- CVE-2026-16503 Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that… CWE-1327
- CVE-2026-55641 9Router is an AI router & token saver. CWE-1327
- CVE-2026-0481 Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could… CWE-1327
- GHSA-525j-hqq2-66r4 OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0 CWE-1327