# CVE-2026-39836: Panic in Dial and LookupPort when handling NUL byte on Windows in net

CVE-2026-39836 is fixed in 13 products on 2 platforms, first by Go Programming Language 1.26.3, released May 7, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-39836
- Priority: High
- CVSS: 7.5 (Important)
- EPSS: 0.0063
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 7, 2026
- Weakness: CWE-248: Uncaught Exception
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-39836

## Description

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Go Programming Language | 1.26.3 | [Go Programming Language 1.26.3](https://patchblox.com/security/data/fix/windows-app/golang.go-1.26.3.md) | May 7, 2026 |
| Linux | delve RHEL 8 | 0:1.25.2-1.module+el8.10.0+23746+9db33b5e | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | delve almalinux 8 | 1.25.2-1.module_el8.10.0+4074+24330916 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | delve ol 8 | 0:1.25.2-1.0.1.module+el8.10.0+90715+2d4d8dfd | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | delve rocky 8 | 0:1.25.2-1.module+el8.10.0+40035+ee0a7047 | [RLSA-2026:22112](https://patchblox.com/security/data/fix/linux/rlsa-2026-22112.md) | Aug 26, 2026 |
| Linux | go-toolset RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | go-toolset RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | go-toolset almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | go-toolset almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | go-toolset ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | go-toolset ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | go-toolset ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | go1.25-openssl opensuse-leap 16.0 | 1.25.12-160000.1.1 | [OPENSUSE-SU-2026:21319-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21319-1.md) | Jul 13, 2026 |
| Linux | go1.25-openssl sles 16.0 | 1.25.12-160000.1.1 | [SUSE-SU-2026:22638-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22638-1.md) | Jul 13, 2026 |
| Linux | go1.26-openssl opensuse-leap 16.0 | 1.26.4-160000.1.1 | [OPENSUSE-SU-2026:21254-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21254-1.md) | Jul 7, 2026 |
| Linux | go1.26-openssl sles 16.0 | 1.26.4-160000.1.1 | [SUSE-SU-2026:22572-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22572-1.md) | Jul 7, 2026 |
| Linux | golang RHEL 10 | 1.26.3-4.el10_2 | [RHSA-2026:22120](https://patchblox.com/security/data/fix/linux/rhsa-2026-22120.md) | May 7, 2026 |
| Linux | golang RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | golang rocky 10 | 0:1.26.3-4.el10_2 | [RLSA-2026:22120](https://patchblox.com/security/data/fix/linux/rlsa-2026-22120.md) | Aug 26, 2026 |
| Linux | golang rocky 8 | 0:1.25.10-1.module+el8.10.0+40200+0fd0f175 | [RLSA-2026:22112](https://patchblox.com/security/data/fix/linux/rlsa-2026-22112.md) | Aug 26, 2026 |
| Linux | golang rocky 9 | 0:1.26.3-1.el9_8 | [RLSA-2026:22121](https://patchblox.com/security/data/fix/linux/rlsa-2026-22121.md) | Aug 26, 2026 |
| Linux | golang-bin RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-bin RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-bin almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-bin almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-bin ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang-bin ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang-bin ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | golang-docs RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-docs RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-docs almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-docs almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-docs ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang-docs ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang-docs ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | golang-misc RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-misc RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-misc almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-misc almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-misc ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang-misc ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang-misc ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | golang-race RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-race RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-race almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-race almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-race ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang-race ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang-race ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | golang-src RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-src RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-src almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-src almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-src ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang-src ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang-src ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | golang-tests RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-tests RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-tests almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-tests almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-tests ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang-tests ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang-tests ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | [OPENSUSE-SU-2026:21483-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21483-1.md) | Jul 30, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.