CVE-2026-33811
Crash when handling long CNAME response in net
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
| Vendor | go standard library |
| Product | net |
| Published | May 7, 2026 |
| Last Updated | Jul 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for go standard library net
Be the first to know when new high vulnerabilities affecting go standard library net are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Go standard library / net
0 < 1.25.10 1.26.0-0 < 1.26.3
References
go.dev: https://go.dev/issue/78803 go.dev: https://go.dev/cl/767860 groups.google.com: https://groups.google.com/g/golang-announce/c/qcCIEXso47M pkg.go.dev: https://pkg.go.dev/vuln/GO-2026-4981 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-33811 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2467822 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36796 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:35832 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34357 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36776 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36617 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34359 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34364 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36625 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36207 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36319 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33574 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36651 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:23262 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:23264 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36648 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:35994 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:35993 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:35995 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33123 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33142 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33150 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33120 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36797
Credits
hamayanhamayan