golang.org/x/tools CVE debriefs

CVE-2026-42503

CVE-2026-42503 is a high-severity vulnerability in gopls, a tool used for debugging Go applications. By default, gopls communicates via a pipe, but it also supports the -port and -listen flags for debugging purposes. If the -listen flag is given a value without an explicit host (e.g., :8080) or if the -port flag is used, gopls will listen on 0.0.0.0. This could inadvertently cause gopls to bind to 0.0.0.0 [truncated]