← CVE Intelligence

CVE-2026-33811

Crash when handling long CNAME response in net PUBLISHED

Description (CNA)

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Affected (CNA)

Vendor / productVersions
Go standard library / netaffected 0 before 1.25.10; affected 1.26.0-0 before 1.26.3

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.