CVE-2026-46600: 
cAdvisor Schwachstellenanalyse und -minderung

CVE-2026-46600 is a Denial of Service vulnerability in the golang.org/x/net/dns/dnsmessage Go package caused by an out-of-bounds read (CWE-125) when parsing malformed SVCB or HTTPS DNS resource records. When the size of a parameter value overflows the message buffer, the parser panics and crashes the service. All versions of golang.org/x/net prior to 0.56.0 are affected. The vulnerability was published on July 21, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is an out-of-bounds read (CWE-125) in the DNS message parser within the golang.org/x/net/dns/dnsmessage package. When parsing SVCB or HTTPS resource records (RRs), the parser does not properly validate that a parameter value's declared size stays within the bounds of the message buffer; an overflow condition triggers a Go runtime panic. The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity — an attacker simply needs to deliver a crafted DNS response or record to a system using the vulnerable parser. The issue is tracked upstream as Go issue #79795 and addressed in code review CL 786345 (GitHub Advisory).

Successful exploitation causes the affected Go service to panic and crash, resulting in a complete loss of availability for any application that parses DNS SVCB or HTTPS resource records using the vulnerable library. There is no impact on confidentiality or data integrity. Any Go application or service (e.g., DNS resolvers, proxies, or network utilities) built with golang.org/x/net versions before 0.56.0 and exposed to untrusted DNS traffic is at risk; downstream products incorporating this library — such as Grafana Tempo, Kapacitor, and others — are also affected (GitHub Advisory).

1. Identify target: Locate services or applications built with golang.org/x/net versions prior to 0.56.0 that parse DNS SVCB or HTTPS resource records (e.g., DNS resolvers, proxies, or network utilities).
2. Craft malicious DNS record: Construct an invalid SVCB or HTTPS DNS resource record where the declared size of a parameter value exceeds the actual message buffer length.
3. Deliver the record: Send the crafted DNS response or record to the target service — for example, via a rogue DNS server, DNS response injection, or by placing the record in a zone the target queries.
4. Trigger panic: The vulnerable dnsmessage parser attempts to read beyond the buffer boundary, triggering a Go runtime panic and crashing the service, resulting in denial of service (GitHub Advisory).

• Logs: Unexpected Go runtime panic messages in application logs referencing golang.org/x/net/dns/dnsmessage or DNS parsing routines; stack traces indicating an out-of-bounds read during SVCB/HTTPS RR parsing.
• Process: Sudden, repeated crashes or restarts of Go-based DNS-handling services without clear operational cause.
• Network: Anomalous DNS responses containing SVCB or HTTPS resource records with malformed or oversized parameter values originating from unexpected sources.

Upgrade golang.org/x/net to version 0.56.0 or later, which contains the fix for this panic condition (Go CL 786345). Downstream projects and products that bundle this library (e.g., Grafana Tempo v2.9.4+, Kapacitor) should be updated to versions that incorporate the patched dependency. As a temporary network-level workaround, restrict DNS traffic to trusted sources to reduce exposure to crafted records. Monitor services for unexpected crashes or restarts as a sign of potential exploitation attempts (GitHub Advisory).

The InfluxData community forum noted the vulnerability in the context of Kapacitor binaries, and Grafana released Tempo v2.9.4 to address it among other dependency updates. No significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability tracking and downstream product advisories.