# CVE-2026-42503

## Summary

- **CVE ID:** CVE-2026-42503
- **Severity:** HIGH
- **CVSS Score:** 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** CWE-1327
- **Published:** May 6, 2026
- **Last Modified:** May 7, 2026

## Description

gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.
If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. 
As a result, users might inadvertently cause gopls to bind 0.0.0.0.
This can allow a malicious party on the same network to execute code arbitrarily via gopls.

## Affected Products

- golang.org/x/tools — golang.org/x/tools/gopls (0.0.0)

## References

- [CNA](https://go.dev/issue/79211)
- [CNA](https://go.dev/cl/774381)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.22%
- **EPSS Percentile:** 12.9

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._