Description
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
Published: 2026-05-07
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:23262 cve-icon
https://access.redhat.com/errata/RHSA-2026:23264 cve-icon
https://access.redhat.com/errata/RHSA-2026:33120 cve-icon
https://access.redhat.com/errata/RHSA-2026:33123 cve-icon
https://access.redhat.com/errata/RHSA-2026:33142 cve-icon
https://access.redhat.com/errata/RHSA-2026:33150 cve-icon
https://access.redhat.com/errata/RHSA-2026:33574 cve-icon
https://access.redhat.com/errata/RHSA-2026:34357 cve-icon
https://access.redhat.com/errata/RHSA-2026:34359 cve-icon
https://access.redhat.com/errata/RHSA-2026:34364 cve-icon
https://access.redhat.com/errata/RHSA-2026:35832 cve-icon
https://access.redhat.com/errata/RHSA-2026:35993 cve-icon
https://access.redhat.com/errata/RHSA-2026:35994 cve-icon
https://access.redhat.com/errata/RHSA-2026:35995 cve-icon
https://access.redhat.com/errata/RHSA-2026:36207 cve-icon
https://access.redhat.com/errata/RHSA-2026:36319 cve-icon
https://access.redhat.com/errata/RHSA-2026:36617 cve-icon
https://access.redhat.com/errata/RHSA-2026:36625 cve-icon
https://access.redhat.com/errata/RHSA-2026:36648 cve-icon
https://access.redhat.com/errata/RHSA-2026:36651 cve-icon
https://access.redhat.com/errata/RHSA-2026:36776 cve-icon
https://access.redhat.com/errata/RHSA-2026:36796 cve-icon
https://access.redhat.com/errata/RHSA-2026:36797 cve-icon
https://access.redhat.com/errata/RHSA-2026:38504 cve-icon
https://access.redhat.com/errata/RHSA-2026:39266 cve-icon
https://access.redhat.com/errata/RHSA-2026:39272 cve-icon
https://access.redhat.com/errata/RHSA-2026:39319 cve-icon
https://access.redhat.com/errata/RHSA-2026:39573 cve-icon
https://access.redhat.com/errata/RHSA-2026:39810 cve-icon
https://access.redhat.com/errata/RHSA-2026:40118 cve-icon
https://access.redhat.com/errata/RHSA-2026:40945 cve-icon
https://access.redhat.com/errata/RHSA-2026:41019 cve-icon
https://access.redhat.com/errata/RHSA-2026:41030 cve-icon
https://access.redhat.com/errata/RHSA-2026:41055 cve-icon
https://access.redhat.com/errata/RHSA-2026:41928 cve-icon
https://access.redhat.com/errata/RHSA-2026:42043 cve-icon
https://access.redhat.com/errata/RHSA-2026:42047 cve-icon
https://access.redhat.com/errata/RHSA-2026:42048 cve-icon
https://access.redhat.com/errata/RHSA-2026:42049 cve-icon
https://access.redhat.com/errata/RHSA-2026:42050 cve-icon
https://access.redhat.com/errata/RHSA-2026:42051 cve-icon
https://access.redhat.com/errata/RHSA-2026:42078 cve-icon
https://access.redhat.com/errata/RHSA-2026:42079 cve-icon
https://access.redhat.com/errata/RHSA-2026:42082 cve-icon
https://access.redhat.com/errata/RHSA-2026:42132 cve-icon
https://access.redhat.com/errata/RHSA-2026:42150 cve-icon
https://access.redhat.com/errata/RHSA-2026:42151 cve-icon
https://access.redhat.com/errata/RHSA-2026:42240 cve-icon
https://access.redhat.com/errata/RHSA-2026:42644 cve-icon
https://access.redhat.com/errata/RHSA-2026:42852 cve-icon
https://access.redhat.com/errata/RHSA-2026:42946 cve-icon
https://access.redhat.com/errata/RHSA-2026:43038 cve-icon
https://access.redhat.com/errata/RHSA-2026:43692 cve-icon
https://access.redhat.com/errata/RHSA-2026:44622 cve-icon
https://access.redhat.com/errata/RHSA-2026:46885 cve-icon
https://access.redhat.com/errata/RHSA-2026:47149 cve-icon
https://access.redhat.com/errata/RHSA-2026:47735 cve-icon
https://access.redhat.com/errata/RHSA-2026:47952 cve-icon
https://access.redhat.com/errata/RHSA-2026:48151 cve-icon
https://access.redhat.com/errata/RHSA-2026:49703 cve-icon
https://access.redhat.com/errata/RHSA-2026:50205 cve-icon
https://access.redhat.com/errata/RHSA-2026:50300 cve-icon
https://access.redhat.com/errata/RHSA-2026:50319 cve-icon
https://access.redhat.com/errata/RHSA-2026:50336 cve-icon
https://access.redhat.com/errata/RHSA-2026:50843 cve-icon
https://access.redhat.com/errata/RHSA-2026:51033 cve-icon
https://access.redhat.com/errata/RHSA-2026:51057 cve-icon
https://access.redhat.com/errata/RHSA-2026:51187 cve-icon
https://access.redhat.com/errata/RHSA-2026:51194 cve-icon
https://access.redhat.com/errata/RHSA-2026:51341 cve-icon
https://access.redhat.com/security/cve/CVE-2026-33811 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2467822 cve-icon
https://go.dev/cl/767860 cve-icon cve-icon
https://go.dev/issue/78803 cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/qcCIEXso47M cve-icon cve-icon
https://pkg.go.dev/vuln/GO-2026-4981 cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json cve-icon
History

Tue, 12 May 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Golang
Golang go
Weaknesses CWE-415
CPEs cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Vendors & Products Golang
Golang go

Mon, 11 May 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Go Standard Library
Go Standard Library net
Vendors & Products Go Standard Library
Go Standard Library net

Fri, 08 May 2026 20:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-415

Fri, 08 May 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 07 May 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-415

Thu, 07 May 2026 20:00:00 +0000

Type Values Removed Values Added
Description When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
Title Crash when handling long CNAME response in net
References

Subscriptions

Go Standard Library Net
Golang Go
cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-08-11T12:04:49.874Z

Reserved: 2026-03-23T20:35:32.814Z

Link: CVE-2026-33811

cve-icon Vulnrichment

Updated: 2026-08-11T12:04:49.874Z

cve-icon NVD

Status : Modified

Published: 2026-05-07T20:16:42.770

Modified: 2026-08-11T13:18:23.800

Link: CVE-2026-33811

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-12T22:30:05Z

Weaknesses