GO-2026-5051 Out-of-bounds read and panic in ReadDir in github.com/cloudsoda/go-smb2 and github.com/hirochachacha/go-smb2
A remote attacker can crash the Go SMB2 client via a malicious server response, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GO-2026-5051?
GO-2026-5051 is a denial of service vulnerability in github.com/cloudsoda/go-smb2, published on 27 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ReadDir and ReadDirPlus parse the QUERY_DIRECTORY SMB response by advancing through entries using the server-supplied NextEntryOffset field. The pre-fix code does not bound next against the remaining buffer before re-slicing, and the entry decoder IsInvalid check performs length arithmetic in int after narrowing from uint16.
A guest or anonymous directory listing against an attacker-controlled or man-in-the-middle SMB server crashes the Go client process with a runtime panic when the response contains an entry whose NextEntryOffset is larger than the remaining buffer, or whose declared FileNameLength produces a length that does not match the actual buffer size.
Which versions are affected by GO-2026-5051?
2 open source packages ship an affected version, including github.com/cloudsoda/go-smb2 and github.com/hirochachacha/go-smb2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cloudsoda/go-smb2 Go | All versions | 0.0.0-20260609183447-7b96c35f5f4b |
github.com/hirochachacha/go-smb2 Go | All versions | None |
How do I fix GO-2026-5051?
Upgrade github.com/cloudsoda/go-smb2 to 0.0.0-20260609183447-7b96c35f5f4b or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GO-2026-5051 being exploited?
There is no known exploitation of GO-2026-5051 in the wild and no public exploit code.