net, x/net/dns/dnsmessage: panic when parsing invalid SVCB record

[neild]

Parsing an invalid SVCB or HTTPS RR can panic when
the size of a parameter value overflows the message buffer.

Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.

This is CVE-2026-46600 and Go issue https://go.dev/issue/79795.

---

This was a PUBLIC track issue, tracked in http://b/517101980.

[gopherbot]

Change https://go.dev/cl/786345 mentions this issue: dns/dnsmessage: avoid panic when parsing SVCB record with truncated data

[Bobi-Wan]

Hi! Has this been patched/backported? I don't seem to be able to track further than the mentioned commit above.

[nicholashusin]

@gopherbot Please open backport for this security issue.

[gopherbot]

Backport issue(s) opened: #80608 (for 1.25), #80609 (for 1.26).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[cherrymui]

Reopen to have it vendored to Go 1.27

[mateusz834]

Reopen to have it vendored to Go 1.27

I don't think we use this in the main Go repo, not sure if we need to vendor+backport this.