When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:23262 cve-icon
https://access.redhat.com/errata/RHSA-2026:23264 cve-icon
https://access.redhat.com/errata/RHSA-2026:33120 cve-icon
https://access.redhat.com/errata/RHSA-2026:33123 cve-icon
https://access.redhat.com/errata/RHSA-2026:33142 cve-icon
https://access.redhat.com/errata/RHSA-2026:33150 cve-icon
https://access.redhat.com/errata/RHSA-2026:33574 cve-icon
https://access.redhat.com/errata/RHSA-2026:34357 cve-icon
https://access.redhat.com/errata/RHSA-2026:34359 cve-icon
https://access.redhat.com/errata/RHSA-2026:34364 cve-icon
https://access.redhat.com/errata/RHSA-2026:35832 cve-icon
https://access.redhat.com/errata/RHSA-2026:35993 cve-icon
https://access.redhat.com/errata/RHSA-2026:35994 cve-icon
https://access.redhat.com/errata/RHSA-2026:35995 cve-icon
https://access.redhat.com/errata/RHSA-2026:36207 cve-icon
https://access.redhat.com/errata/RHSA-2026:36319 cve-icon
https://access.redhat.com/errata/RHSA-2026:36617 cve-icon
https://access.redhat.com/errata/RHSA-2026:36625 cve-icon
https://access.redhat.com/errata/RHSA-2026:36648 cve-icon
https://access.redhat.com/errata/RHSA-2026:36651 cve-icon
https://access.redhat.com/errata/RHSA-2026:36776 cve-icon
https://access.redhat.com/errata/RHSA-2026:36796 cve-icon
https://access.redhat.com/errata/RHSA-2026:36797 cve-icon
https://access.redhat.com/errata/RHSA-2026:38504 cve-icon
https://access.redhat.com/errata/RHSA-2026:39266 cve-icon
https://access.redhat.com/errata/RHSA-2026:39272 cve-icon
https://access.redhat.com/errata/RHSA-2026:39319 cve-icon
https://access.redhat.com/errata/RHSA-2026:39573 cve-icon
https://access.redhat.com/errata/RHSA-2026:39810 cve-icon
https://access.redhat.com/errata/RHSA-2026:40118 cve-icon
https://access.redhat.com/errata/RHSA-2026:40945 cve-icon
https://access.redhat.com/errata/RHSA-2026:41019 cve-icon
https://access.redhat.com/errata/RHSA-2026:41030 cve-icon
https://access.redhat.com/errata/RHSA-2026:41055 cve-icon
https://access.redhat.com/errata/RHSA-2026:41928 cve-icon
https://access.redhat.com/errata/RHSA-2026:42043 cve-icon
https://access.redhat.com/errata/RHSA-2026:42047 cve-icon
https://access.redhat.com/errata/RHSA-2026:42048 cve-icon
https://access.redhat.com/errata/RHSA-2026:42049 cve-icon
https://access.redhat.com/errata/RHSA-2026:42050 cve-icon
https://access.redhat.com/errata/RHSA-2026:42051 cve-icon
https://access.redhat.com/errata/RHSA-2026:42078 cve-icon
https://access.redhat.com/errata/RHSA-2026:42079 cve-icon
https://access.redhat.com/errata/RHSA-2026:42082 cve-icon
https://access.redhat.com/errata/RHSA-2026:42132 cve-icon
https://access.redhat.com/errata/RHSA-2026:42150 cve-icon
https://access.redhat.com/errata/RHSA-2026:42151 cve-icon
https://access.redhat.com/errata/RHSA-2026:42240 cve-icon
https://access.redhat.com/errata/RHSA-2026:42644 cve-icon
https://access.redhat.com/errata/RHSA-2026:42852 cve-icon
https://access.redhat.com/errata/RHSA-2026:42946 cve-icon
https://access.redhat.com/errata/RHSA-2026:43038 cve-icon
https://access.redhat.com/errata/RHSA-2026:43692 cve-icon
https://access.redhat.com/errata/RHSA-2026:44622 cve-icon
https://access.redhat.com/errata/RHSA-2026:46885 cve-icon
https://access.redhat.com/errata/RHSA-2026:47149 cve-icon
https://access.redhat.com/errata/RHSA-2026:47735 cve-icon
https://access.redhat.com/errata/RHSA-2026:47952 cve-icon
https://access.redhat.com/errata/RHSA-2026:48151 cve-icon
https://access.redhat.com/errata/RHSA-2026:49703 cve-icon
https://access.redhat.com/errata/RHSA-2026:50205 cve-icon
https://access.redhat.com/errata/RHSA-2026:50300 cve-icon
https://access.redhat.com/errata/RHSA-2026:50319 cve-icon
https://access.redhat.com/errata/RHSA-2026:50336 cve-icon
https://access.redhat.com/errata/RHSA-2026:50843 cve-icon
https://access.redhat.com/errata/RHSA-2026:51033 cve-icon
https://access.redhat.com/errata/RHSA-2026:51057 cve-icon
https://access.redhat.com/errata/RHSA-2026:51187 cve-icon
https://access.redhat.com/errata/RHSA-2026:51194 cve-icon
https://access.redhat.com/errata/RHSA-2026:51341 cve-icon
https://access.redhat.com/errata/RHSA-2026:53412 cve-icon
https://access.redhat.com/errata/RHSA-2026:53413 cve-icon
https://access.redhat.com/errata/RHSA-2026:53415 cve-icon
https://access.redhat.com/errata/RHSA-2026:53530 cve-icon
https://access.redhat.com/errata/RHSA-2026:54168 cve-icon
https://access.redhat.com/errata/RHSA-2026:54191 cve-icon
https://access.redhat.com/errata/RHSA-2026:54283 cve-icon
https://access.redhat.com/errata/RHSA-2026:54285 cve-icon
https://access.redhat.com/errata/RHSA-2026:54287 cve-icon
https://access.redhat.com/security/cve/CVE-2026-33811 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2467822 cve-icon
https://go.dev/cl/767860 cve-icon cve-icon
https://go.dev/issue/78803 cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/qcCIEXso47M cve-icon cve-icon
https://pkg.go.dev/vuln/GO-2026-4981 cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json cve-icon
History

Wed, 12 Aug 2026 12:30:00 +0000


Tue, 12 May 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Golang
Golang go
Weaknesses CWE-415
CPEs cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Vendors & Products Golang
Golang go

Mon, 11 May 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Go Standard Library
Go Standard Library net
Vendors & Products Go Standard Library
Go Standard Library net

Fri, 08 May 2026 20:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-415

Fri, 08 May 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 07 May 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-415

Thu, 07 May 2026 20:00:00 +0000

Type Values Removed Values Added
Description When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
Title Crash when handling long CNAME response in net
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-08-12T12:04:43.176Z

Reserved: 2026-03-23T20:35:32.814Z

Link: CVE-2026-33811

cve-icon Vulnrichment

Updated: 2026-08-11T12:04:49.874Z

cve-icon NVD

Status : Modified

Published: 2026-05-07T20:16:42.770

Modified: 2026-08-12T12:18:46.990

Link: CVE-2026-33811

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-12T22:30:05Z

Weaknesses

No weakness.