Описание
gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.
If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.
As a result, users might inadvertently cause gopls to bind 0.0.0.0.
This can allow a malicious party on the same network to execute code arbitrarily via gopls.
A flaw was found in gopls. When started with -listen using a hostless address (for example :8080) or with -port, the language server binds to 0.0.0.0 instead of localhost, exposing the debug interface to the local network and allowing arbitrary code execution by a malicious party on the same network.
Отчет
gopls is vulnerable to arbitrary code execution when debug flags cause it to listen on all interfaces. Using -listen without an explicit host or the -port flag binds 0.0.0.0, so any attacker on the same network can reach the gopls debug endpoint and run code in the developer context. Red Hat exposure is in hummingbird golang1.25 and golang1.26 toolchains and the trivy component that bundles gopls for Go language support.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | trivy | Not affected | ||
| Red Hat Hardened Images | golang1-25-main-1.25.9-1.hum1 | Fixed | RHSA-2026:7385 | 10.04.2026 |
| Red Hat Hardened Images | golang1-26-main-1.26.2-1.1.hum1 | Fixed | RHSA-2026:8291 | 15.04.2026 |
Показывать по
Дополнительная информация
Статус:
8.8 High
CVSS3
Связанные уязвимости
gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.
gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.
gopls by default communicates via pipe. However, -port and -listen fla ...
gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.
8.8 High
CVSS3