Skip to main content

Go net library CVE-2026-33811

| EUVDEUVD-2026-28419 HIGH
Double Free (CWE-415)
2026-05-07 Go GHSA-497x-jcxf-m478
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
May 08, 2026 - 15:22 vuln.today
CVSS changed
May 08, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
May 07, 2026 - 21:02 EUVD
CVE Published
May 07, 2026 - 19:41 nvd
UNKNOWN (no severity yet)
CVE Published
May 07, 2026 - 19:41 nvd
HIGH 7.5

DescriptionNVD

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

AnalysisAI

Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing maliciously crafted CNAME DNS responses. Remote attackers can trigger double-free of C memory in the cgo DNS resolver's LookupCNAME function by sending excessively long CNAME records, causing immediate denial of service. EPSS score of 0.01% (1st percentile) indicates minimal observed exploitation activity despite network-accessible attack vector and no authentication requirement. Vendor patch available via Go 1.25.10 and 1.26.3.

Technical ContextAI

This vulnerability affects Go's net standard library, specifically the cgo-based DNS resolver implementation. The cgo resolver uses C bindings to interact with system DNS facilities. When processing CNAME (Canonical Name) records via the LookupCNAME function, inadequate bounds checking on response length triggers a double-free condition-a memory management error where the same C memory allocation is freed twice. Double-free vulnerabilities corrupt heap metadata and typically result in immediate process termination. The affected component (CPE: cpe:2.3:a:go_standard_library:net) is a core networking library used by virtually all Go applications that perform DNS lookups, making this a supply-chain concern. The vulnerability specifically affects applications compiled with cgo enabled (the default on most platforms) that rely on system DNS resolution rather than Go's pure-Go resolver.

RemediationAI

Upgrade Go to version 1.25.10 or later (for 1.25.x users) or version 1.26.3 or later (for 1.26.x users) as documented in the official golang-announce mailing list (https://groups.google.com/g/golang-announce/c/qcCIEXso47M). Recompile all affected applications with the patched Go toolchain, as the fix is implemented in the standard library and requires rebuilding binaries. No configuration changes are required post-upgrade. For environments unable to immediately patch, implement DNS response filtering at network boundary to reject CNAME records exceeding RFC 1035 length limits (255 octets per label, 1024 octets total), though this adds operational complexity and potential for legitimate response rejection. Alternatively, force use of Go's pure-Go DNS resolver by setting GODEBUG=netdns=go environment variable, which bypasses the vulnerable cgo path entirely but may exhibit different DNS behavior on some systems (e.g., not respecting /etc/hosts). Advisory URL with vulnerability database entry: https://pkg.go.dev/vuln/GO-2026-4981.

More in Net

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2023-38180 HIGH
7.5 Aug 08

.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e

CVE-2026-62886 HIGH POC
7.8 Aug 11

Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f

CVE-2026-62871 HIGH POC
7.8 Aug 11

Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r

CVE-2026-70354 HIGH POC
7.8 Aug 11

Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full

CVE-2026-62909 HIGH POC
7.8 Aug 11

Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows

CVE-2026-62901 HIGH POC
7.5 Aug 11

Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang

CVE-2026-62897 HIGH POC
7.0 Aug 11

Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com

CVE-2026-62898 HIGH POC
7.5 Aug 11

Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u

CVE-2026-39836 HIGH POC
7.5 May 07

Denial of service in the Go standard library's net package (on Windows) allows remote attackers to crash applications by

CVE-2018-17848 HIGH POC
7.5 Oct 01

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "

CVE-2018-17847 HIGH POC
7.5 Oct 01

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

CVE-2026-33811 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy