{"id":"CVE-2026-42503","title":"gopls by default communicates via pipe","summary":"gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.\nIf -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. \nAs a result…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-1327"],"vendor":"golang","product":"gopls","affected":["gopls < 0.22.0"],"patched":["gopls 0.22.0"],"published":"2026-05-06","updated":"2026-09-18","sourceUpdated":"2026-09-18T15:16:51.937","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42503","references":[{"url":"https://go.dev/cl/774381","label":"security@golang.org"},{"url":"https://go.dev/issue/79211","label":"security@golang.org"}],"tags":["nvd"],"epss":0.00212,"epssPercentile":0.11843,"ingestedAt":"2026-09-18T15:44:31.553Z","slug":"CVE-2026-42503","body":"## Overview\n\ngopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.\nIf -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. \nAs a result, users might inadvertently cause gopls to bind 0.0.0.0.\nThis can allow a malicious party on the same network to execute code arbitrarily via gopls.\n\n## Affected\n\n- `gopls < 0.22.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `gopls 0.22.0`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}