Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps golang.org/x/net/golang.org/x/net/dns/dnsmessage (generic), Go standard library/net (generic), golang.org/x/net (go), stdlib (go). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for golang.org/x/net/golang.org/x/net/dns/dnsmessage, Go standard library/net, golang.org/x/net.
2. 2Review the reported fix. Update golang.org/x/net/golang.org/x/net/dns/dnsmessage to 0.56.0; Go standard library/net to 1.26.6; golang.org/x/net to 0.56.0; stdlib to 1.26.6 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Jul 21, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 13, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 13, 2026

Sources and claim methodology

• Source referencego.dev
• Source referencego.dev
• Source referencegroups.google.com
• Source referencepkg.go.dev

Related CVEs

• Enforce maximum recursion depth in encoding/asn1Same stdlib package
• Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpSame stdlib package
• Fix Javascript regexp context tracking in html/templateSame stdlib package
• Add recursion depth guard during decode in encoding/xmlSame stdlib package
• Avoid quadratic complexity in resolvePath in net/urlSame stdlib package
• Limit handshake messages we are willing to accept post-handshake in crypto/tlsSame stdlib package

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps golang.org/x/net/golang.org/x/net/dns/dnsmessage (generic), Go standard library/net (generic), golang.org/x/net (go), stdlib (go). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for golang.org/x/net/golang.org/x/net/dns/dnsmessage, Go standard library/net, golang.org/x/net.
2. 2Review the reported fix. Update golang.org/x/net/golang.org/x/net/dns/dnsmessage to 0.56.0; Go standard library/net to 1.26.6; golang.org/x/net to 0.56.0; stdlib to 1.26.6 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Jul 21, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 13, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 13, 2026

Sources and claim methodology

• Source referencego.dev
• Source referencego.dev
• Source referencegroups.google.com
• Source referencepkg.go.dev

Related CVEs

• Enforce maximum recursion depth in encoding/asn1Same stdlib package
• Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpSame stdlib package
• Fix Javascript regexp context tracking in html/templateSame stdlib package
• Add recursion depth guard during decode in encoding/xmlSame stdlib package
• Avoid quadratic complexity in resolvePath in net/urlSame stdlib package
• Limit handshake messages we are willing to accept post-handshake in crypto/tlsSame stdlib package