CVE-2026-46600: DNS SVCB/HTTPS RR Buffer Overflow Flaw

CVE-2026-46600 Overview

CVE-2026-46600 is a high-severity vulnerability in the Go standard library's DNS message parsing logic. Parsing an invalid Service Binding (SVCB) or HTTPS Resource Record (RR) can trigger a panic when the size of a parameter value overflows the message buffer. The flaw is classified as an out-of-bounds read [CWE-125] and can be triggered remotely by an attacker who supplies a crafted DNS response or record to a Go application performing DNS parsing. Exploitation results in a denial-of-service condition against the affected process.

Critical Impact
Remote, unauthenticated attackers can crash Go-based services that parse SVCB or HTTPS DNS records by sending a malformed record whose parameter length exceeds the message buffer.

Affected Products

Go standard library net DNS message parsing (see Go.dev Vulnerability Advisory GO-2026-5942)
Go applications and services that parse SVCB Resource Records
Go applications and services that parse HTTPS Resource Records

Discovery Timeline

2026-07-21 - CVE-2026-46600 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-46600

Vulnerability Analysis

The vulnerability resides in the DNS message parser that handles SVCB and HTTPS Resource Records. Both record types carry a list of key/value parameters (SvcParams), where each parameter includes a length field followed by a value payload. The parser fails to validate that the declared parameter value length fits within the remaining bytes of the DNS message buffer. When the length exceeds the buffer boundary, the parser reads past the end of the allocated slice and triggers a runtime panic.

Because DNS parsing occurs before any application-level authentication, an attacker only needs to deliver a single crafted record to a listener or resolver client. The panic terminates the goroutine handling the request and, depending on how the application supervises goroutines, can crash the entire process. The issue is tracked upstream in Go issue 79795 and fixed in Go change 786345.

Root Cause

The root cause is missing bounds validation on the SvcParam value length field during SVCB/HTTPS RR parsing [CWE-125]. The parser trusts the attacker-controlled length without confirming it against the remaining message length, leading to an out-of-bounds slice access and a Go runtime panic.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted DNS response containing a malformed SVCB or HTTPS record to any Go application that parses DNS messages. Suitable delivery paths include on-path DNS responses to Go clients, malicious authoritative responses, and inbound queries to Go-based DNS servers or proxies that echo or process SVCB/HTTPS records.

No verified public exploit code is available at this time. The vulnerability mechanism is described in the Go.dev Issue Report.

Detection Methods for CVE-2026-46600

Indicators of Compromise

Unexpected runtime error: slice bounds out of range panics in Go application logs referencing net/dnsmessage or SVCB/HTTPS parsing frames.
Repeated process restarts or goroutine crashes correlated with inbound DNS traffic containing SVCB (type 64) or HTTPS (type 65) records.
Malformed DNS responses in packet captures where the SvcParam value length exceeds the record's RDLENGTH.

Detection Strategies

Inspect DNS traffic for SVCB and HTTPS records whose SvcParamValue length fields extend beyond the containing message.
Monitor Go application stack traces for panics originating in DNS message parsing routines.
Use software composition analysis to identify binaries compiled with vulnerable Go toolchain or golang.org/x/net/dns/dnsmessage versions listed in GO-2026-5942.

Monitoring Recommendations

Alert on abnormal restart rates for Go-based DNS resolvers, service meshes, and network proxies.
Log and review DNS parser errors at the application layer rather than silently discarding them.
Track outbound DNS queries that return SVCB/HTTPS records from untrusted resolvers and flag anomalous responses.

How to Mitigate CVE-2026-46600

Immediate Actions Required

Rebuild affected Go applications using a Go toolchain that includes the fix from Go change 786345.
Update the golang.org/x/net/dns/dnsmessage dependency to the patched version referenced in GO-2026-5942 and redeploy.
Run govulncheck across your Go codebase to enumerate binaries and modules that call the vulnerable parsing paths.

Patch Information

The Go project has published the fix in upstream change go.dev/cl/786345, tracked under issue go.dev/issue/79795 and advisory GO-2026-5942. Rebuild all Go binaries with the patched toolchain and update any vendored copies of golang.org/x/net.

Workarounds

Restrict DNS resolution to trusted internal resolvers that validate and normalize SVCB/HTTPS records before forwarding.
Drop or filter SVCB (type 64) and HTTPS (type 65) resource records at network boundaries where they are not required.
Isolate DNS parsing in supervised worker processes so a panic does not terminate the parent service.

bash

# Configuration example
# Enumerate affected modules and rebuild with a patched Go toolchain
govulncheck ./...
go get golang.org/x/net@latest
go build -trimpath ./...