An out-of-bounds read vulnerability in the Go networking library allows unauthenticated remote attackers to trigger a denial of service via malformed DNS records.

This is an out-of-bounds read flaw, classified under CWE-125, where parsing crafted SVCB or HTTPS resource records triggers a panic due to buffer size handling. The attack vector is entirely network-based and requires no authentication or user interaction.

A successful exploitation of this vulnerability leads to an application crash, causing significant service disruption and availability loss for dependent systems. With a CVSS score of 7.5, the risk is rated as high because remote attackers can repeatedly disrupt critical network services without needing prior access or privileges.

Immediate Action: Update golang.org/x/net and related DNS parsing packages to version 0.56.0 or later, and update Go runtime environments to the patched releases.

Proactive Monitoring: Monitor application error logs and telemetry for unexpected panics, sudden service restarts, or abnormal spikes in malformed DNS query handling.

Compensating Controls: Implement robust rate limiting and upstream DNS filtering to drop malformed or anomalous SVCB and HTTPS resource record queries before they reach the vulnerable parser.

Public Exploit Available: No - there is no confirmed public exploit in the available data.

Organizations utilizing the affected Go networking modules must prioritize applying the latest software updates to neutralize availability risks. Immediate remediation is strongly advised to prevent potential denial of service disruptions against core networking infrastructure.