CVE-2026-33811

A flaw was found in the net package of Go (golang), specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.

This is an Important denial of service vulnerability in the Go net package, affecting applications configured to use the cgo DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the cgo DNS resolver. This can be achieved by setting the GODEBUG environment variable to netdns=go. For example, to run a Go application with this mitigation: GODEBUG=netdns=go /path/to/your/go/application. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.