CVE-2026-42503: gopls Remote Code Execution Vulnerability

CVE-2026-42503 Overview

CVE-2026-42503 is a high-severity vulnerability in gopls, the official Go language server used by editors and IDEs to provide code intelligence for Go projects. By default, gopls communicates with its client over a pipe. However, the debugging flags -port and -listen change this behavior. When -listen receives a value without an explicit host (for example, :8080) or when -port is supplied, gopls binds to 0.0.0.0 and accepts connections from any network interface. An attacker on the same network segment can connect to the exposed listener and execute arbitrary code through the language server.

Critical Impact

Adjacent network attackers can achieve arbitrary code execution against developer workstations running gopls with debug flags that bind to all interfaces.

Affected Products

• gopls (Go language server) when launched with the -port flag
• gopls when launched with -listen using a value lacking an explicit host (e.g. :8080)
• Developer environments and IDE integrations that pass these debug flags to gopls

Discovery Timeline

• 2026-05-06 - CVE-2026-42503 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-42503

Vulnerability Analysis

gopls is the Go language server that exposes Language Server Protocol (LSP) functionality to editors. LSP traffic typically traverses standard input and output pipes between the editor and the server process. The -port and -listen flags exist to support debugging scenarios where developers want to attach a network client to a running language server instance.

The issue lies in how host parsing handles incomplete listener specifications. When a user supplies -listen :8080 or -port 8080, gopls resolves the missing host to the wildcard address 0.0.0.0 rather than 127.0.0.1. This binds the LSP socket to every network interface on the machine. Any host on the same broadcast or routed segment can then reach the listener.

Because the language server accepts LSP requests that drive code execution actions, file operations, and tool invocations, an attacker who can speak LSP to the open port can pivot that access into arbitrary code execution on the developer's workstation. The CWE classification [CWE-1327] reflects the binding to an unrestricted IP address.

Root Cause

The root cause is an insecure default for the listener host. When the host portion is omitted from -listen, or when -port is used as a shorthand, gopls selects 0.0.0.0 instead of a loopback address. Developers reasonably expect a debugging flag to expose the service only to the local machine.

Attack Vector

Exploitation requires adjacent network access (AV:A) to a workstation running gopls with -port or a host-less -listen value. The attacker scans the segment for the configured port, opens a TCP connection, and issues LSP requests that trigger code execution paths within the language server. No authentication is required and no user interaction is needed.

No verified proof-of-concept code is published. See the upstream change list for the technical fix at Go.dev Change Log Entry and the issue tracker entry at Go.dev Issue Tracker Entry.

Detection Methods for CVE-2026-42503

Indicators of Compromise

• Unexpected gopls processes with command-line arguments containing -port or -listen values that omit a host
• TCP listeners bound to 0.0.0.0 on developer endpoints owned by gopls
• Inbound connections to gopls debug ports from hosts other than the local machine

Detection Strategies

• Inventory running processes for gopls invocations and inspect arguments for -port or -listen :PORT patterns
• Monitor netstat, ss, or equivalent telemetry for sockets owned by gopls bound to non-loopback interfaces
• Alert on any LSP traffic to gopls ports originating from remote IP addresses

Monitoring Recommendations

• Centralize endpoint process and network telemetry from developer workstations for retrospective hunting
• Track child processes spawned by gopls to surface tool executions triggered through LSP requests
• Correlate developer workstation listening ports against an allowlist that excludes wildcard binds for development tooling

How to Mitigate CVE-2026-42503

Immediate Actions Required

• Stop using -port and bare -listen :PORT arguments with gopls until the patched version is deployed
• Update gopls to the fixed release referenced in the upstream change list at Go.dev Change Log Entry
• Audit editor and IDE configurations across the developer fleet for arguments that pass these flags to gopls

Patch Information

The Go team addressed the issue in the change tracked at Go.dev Change Log Entry, with discussion at Go.dev Issue Tracker Entry. Upgrade gopls to the fixed version distributed by the Go toolchain.

Workarounds

• When debugging is required, always specify an explicit loopback host: use -listen 127.0.0.1:8080 instead of -listen :8080
• Restrict developer workstation firewalls to drop inbound TCP connections on ephemeral high ports from non-local sources
• Run developer environments on isolated network segments that prevent peer-to-peer reachability between workstations

# Configuration example: bind gopls debug listener to loopback only
gopls -listen 127.0.0.1:8080 serve

# Verify the listener is not bound to 0.0.0.0
ss -tlnp | grep gopls