CVE-2026-46600

A flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding SVCB or HTTPS resource record RR to a system using this component. When parsing this invalid record, the system may panic due to a parameter value overflowing the message buffer...

CVE-2026-46600

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...