CVE-2026-42503

Name of the Vulnerable Software and Affected Versions gopls (affected versions not specified)

Description By default, the software communicates via pipe, but the -port and -listen flags are available for debugging. If the -listen flag is provided without an explicit host (e.g., ':8080') or if the -port flag is used, the application binds to 0.0.0.0. This configuration may allow a malicious actor on the same network to achieve arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.