CVE-2026-46600

highCVSS 7.5covered by 2 sourcesfirst seen 2026-07-14

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

CSIRTS triage

What: Parsing an invalid SVCB or HTTPS resource record can cause a panic in the DNS message handling.
Who is affected: Deployments using the golang.org/x/net/dns/dnsmessage package may be affected.
Urgency: Remediation is urgent due to the high severity and potential for application crashes.
Action: Update to the latest version of the golang.org/x/net package.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-46600

Get an email if CVE-2026-46600 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Low exploitation risk0.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-46600 status](https://www.csirts.com/badge/CVE-2026-46600)](https://www.csirts.com/cve/CVE-2026-46600)