CVE-2026-46600: 
cAdvisor Analisi e mitigazione delle vulnerabilità

CVE-2026-46600 is a denial-of-service vulnerability in the golang.org/x/net/dns/dnsmessage Go package that causes a panic when parsing an invalid SVCB or HTTPS DNS resource record (RR) whose parameter value size overflows the message buffer. It affects all versions of golang.org/x/net prior to 0.56.0. The vulnerability was published on July 21, 2026, with a patch available in the same release cycle. The CVSS base score is currently listed as 0.0 (pending full NVD analysis), though Feedly estimates the severity as HIGH (GitHub Advisory, Go Vuln DB).

The root cause is an integer overflow or out-of-bounds read (consistent with CWE-125) in the DNS message parser within golang.org/x/net/dns/dnsmessage. When parsing SVCB or HTTPS resource records, the parser does not adequately validate that the declared size of a parameter value stays within the bounds of the message buffer; an overflow condition triggers a Go runtime panic, crashing the calling process. Exploitation requires only that an attacker can deliver a malformed DNS response or record to an application using this library for DNS parsing. The fix is tracked in Go issue #79795 and implemented in code review CL 786345 (Go Issue, Go CL, Go Vuln DB).

Successful exploitation causes the affected Go application to panic and crash, resulting in a denial of service. Any service that uses golang.org/x/net/dns/dnsmessage to parse DNS responses — including DNS resolvers, proxies, or any application performing DNS lookups via this library — is at risk of being remotely crashed by an unauthenticated attacker. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss (GitHub Advisory, Go Vuln DB).

1. Identify target: Locate services or applications built with Go that use golang.org/x/net versions prior to 0.56.0 for DNS message parsing (e.g., DNS resolvers, custom DNS clients, or proxies).
2. Craft malicious DNS record: Construct a malformed SVCB or HTTPS DNS resource record in which the declared size of a parameter value is set to overflow the message buffer boundary.
3. Deliver the payload: Position the malicious record so it is returned to the target application — for example, by controlling a DNS server that the target queries, performing DNS spoofing/poisoning, or injecting the record via a man-in-the-middle position on the network.
4. Trigger panic: When the target application's DNS parser processes the malformed record, the buffer overflow condition triggers a Go runtime panic, crashing the service and causing a denial of service (Go Issue, Go Vuln DB).

• Logs: Unexpected Go runtime panic messages in application logs, particularly referencing dns/dnsmessage or SVCB/HTTPS record parsing; log entries showing abrupt service termination.
• Process: Sudden crash or restart of Go-based DNS-handling services without a clear operational cause.
• Network: Anomalous DNS responses containing SVCB or HTTPS resource records with malformed or oversized parameter values arriving from unexpected or external DNS servers.

Upgrade golang.org/x/net to version 0.56.0 or later, which contains the fix for this vulnerability. If immediate patching is not possible, consider implementing network-level filtering to restrict DNS traffic to trusted, known-good resolvers, reducing the attack surface for malicious DNS responses. Monitor affected services for unexpected crashes or restarts as a sign of potential exploitation attempts (Go Vuln DB, Go CL).