Parsing an invalid SVCB or HTTPS resource record can trigger a panic in golang.org/x/net/dns/dnsmessage when a parameter value’s size causes an integer overflow during buffer allocation, resulting in a crash. This flaw is classified as an out‑of‑bounds read (CWE‑125) that leads to the application terminating. The loss of availability occurs regardless of any data being compromised, as the application stops functioning when the panic propagates.

Any Go application that imports golang.org/x/net/dns/dnsmessage and processes DNS traffic is potentially vulnerable. Common examples include DNS servers, resolvers, and network tools written in Go. No specific version ranges are listed, so all releases before the fix may be affected.

The CVSS score of 7.5 indicates moderate to high severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is network‑based: an attacker only needs the ability to send crafted DNS queries to the vulnerable service. Once triggered, the panic causes a denial of service but does not leak or alter data.