Skip to main content

Go net library CVE-2026-33811

| EUVDEUVD-2026-28419 HIGH
Double Free (CWE-415)
2026-05-07 Go GHSA-497x-jcxf-m478
Denial Of Service Net Go Standard Library
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker positions DNS server
  2. Delivery
    Target app queries CNAME
  3. Exploit
    Malicious oversized CNAME response delivered
  4. Execution
    cgo resolver parses response
  5. Persist
    Double-free triggered
  6. Impact
    Application crash (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-415
ASVS 5.0
V15 - Secure Coding and Architecture Double free prevention
Exploitation Conditions

Requires Go application using the cgo DNS resolver (default on Unix-like systems) to perform CNAME lookups against attacker-controlled or attacker-compromised DNS infrastructure. Specifically, the application must call net.LookupCNAME or higher-level functions that internally invoke CNAME resolution (such as net.LookupHost under certain conditions). Exploitation requires network positioning to deliver malicious DNS responses: operating authoritative nameserver for queried domain, man-in-the-middle network access to intercept/modify DNS traffic, or successful DNS cache poisoning. Applications using GODEBUG=netdns=go (pure-Go resolver) are not vulnerable. Attack complexity is low per CVSS (AC:L) once positioning achieved, but gaining that positioning against hardened DNS infrastructure requires moderate attacker sophistication. Limits exploitation: requires DNS query initiation by target application against attacker-influenced namespace, making this primarily a concern for applications resolving arbitrary user-supplied or external domain names rather than fixed internal hostnames.
Impact

CVSS 7.5 (High) reflects network accessibility (AV:N), low attack complexity (AC:L), no authentication (PR:N), and high availability impact (A:H), indicating straightforward exploitation for denial of service. However, EPSS 0.01% (1st percentile) suggests minimal real-world exploitation attempts post-disclosure, likely because DNS CNAME manipulation requires attacker control of DNS infrastructure (authoritative servers, MITM position, or cache poisoning) rather than simple HTTP request forgery. SSVC assessment: Exploitation status is publicly available exploit code exists (vendor confirmed via security advisory), automatable as YES (DNS response parsing is deterministic), technical impact of partial (availability only). The contradiction between 'easy to exploit' CVSS vector and low EPSS likely stems from limited attacker positioning-DNS response manipulation requires more sophisticated network access than typical web vulnerabilities. Real-world priority is MEDIUM: patch urgently for internet-facing Go services performing DNS lookups against untrusted domains, but lower urgency for internal applications with controlled DNS infrastructure. Impact limited to crash/restart rather than code execution or data breach.
Exploit ScenarioDerived

Attacker operates or compromises an authoritative DNS server for a domain queried by the target Go application. When the application calls LookupCNAME (directly or indirectly via higher-level DNS functions), the attacker's DNS server responds with a maliciously crafted CNAME record containing an excessively long hostname field. The cgo DNS resolver attempts to process this response, triggering the double-free condition in C memory management routines, immediately crashing the Go application. No public exploit code identified at time of analysis, but attack mechanics are straightforward for adversaries with DNS infrastructure control.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 08, 2026

Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing maliciously crafted CNAME DNS responses. Remote attackers can trigger double-free of C memory in the cgo DNS resolver's LookupCNAME function by sending excessively long CNAME records, causing immediate denial of service. EPSS score of 0.01% (1st percentile) indicates minimal observed exploitation activity despite network-accessible attack vector and no authentication requirement. Vendor patch available via Go 1.25.10 and 1.26.3.

RemediationAI

Upgrade Go to version 1.25.10 or later (for 1.25.x users) or version 1.26.3 or later (for 1.26.x users) as documented in the official golang-announce mailing list (https://groups.google.com/g/golang-announce/c/qcCIEXso47M). Recompile all affected applications with the patched Go toolchain, as the fix is implemented in the standard library and requires rebuilding binaries. No configuration changes are required post-upgrade. For environments unable to immediately patch, implement DNS response filtering at network boundary to reject CNAME records exceeding RFC 1035 length limits (255 octets per label, 1024 octets total), though this adds operational complexity and potential for legitimate response rejection. Alternatively, force use of Go's pure-Go DNS resolver by setting GODEBUG=netdns=go environment variable, which bypasses the vulnerable cgo path entirely but may exhibit different DNS behavior on some systems (e.g., not respecting /etc/hosts). Advisory URL with vulnerability database entry: https://pkg.go.dev/vuln/GO-2026-4981.

Affected VersionsENISA

net 0 <1.25.10
net 1.26.0-0 <1.26.3

Affected Packages

go stdlib fix: 1.25.10, 1.26.3
euvd net fix: 1.25.10, 1.26.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects Go's net standard library, specifically the cgo-based DNS resolver implementation. The cgo resolver uses C bindings to interact with system DNS facilities. When processing CNAME (Canonical Name) records via the LookupCNAME function, inadequate bounds checking on response length triggers a double-free condition-a memory management error where the same C memory allocation is freed twice. Double-free vulnerabilities corrupt heap metadata and typically result in immediate process termination. The affected component (CPE: cpe:2.3:a:go_standard_library:net) is a core networking library used by virtually all Go applications that perform DNS lookups, making this a supply-chain concern. The vulnerability specifically affects applications compiled with cgo enabled (the default on most platforms) that rely on system DNS resolution rather than Go's pure-Go resolver.

Know when Net gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
May 08, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
May 07, 2026 - 21:02 EUVD
CVE Published
May 07, 2026 - 19:41 nvd
UNKNOWN (no severity yet)
CVE Published
May 07, 2026 - 19:41 nvd
HIGH 7.5

DescriptionNVD

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Executive ViewAI

Why It Matters

Go applications using versions prior to 1.25.10 or 1.26.0-1.26.2 are vulnerable to remote denial of service attacks through crafted DNS CNAME responses, potentially disrupting services that depend on DNS resolution. Any internet-facing Go application performing DNS lookups can be targeted by unauthenticated attackers without user interaction, requiring immediate patching to restore service availability.

Business Impact: High
Compensating Controls

Vendor-released patch: Go 1.25.10 and Go 1.26.3. Until patching is complete, implement network-level DNS request filtering and rate-limiting on DNS resolvers, restrict DNS traffic to trusted resolvers only, and monitor application logs for unexpected crashes or denial of service patterns.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Net

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2026-111497 CRITICAL POC
9.2 Oct 21

Remote code execution is possible in Node.js releases that bundle a vulnerable Brotli decoder: a malformed brotli-compre
CVE-2023-38180 HIGH
7.5 Aug 08

.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
CVE-2026-69439 HIGH POC
8.8 Sep 08

Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker
CVE-2026-71328 HIGH POC
8.8 Sep 08

Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
CVE-2026-62886 HIGH POC
7.8 Aug 11

Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
CVE-2026-62871 HIGH POC
7.8 Aug 11

Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
CVE-2026-70354 HIGH POC
7.8 Aug 11

Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full

CVE-2026-62909 HIGH POC
7.8 Aug 11

Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows

CVE-2026-62901 HIGH POC
7.5 Aug 11

Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang

CVE-2026-62897 HIGH POC
7.0 Aug 11

Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
CVE-2026-62898 HIGH POC
7.5 Aug 11

Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-33811 ADVISORY https://vuldb.com/vuln/361952 REF https://access.redhat.com/errata/RHSA-2026:22112 REF https://access.redhat.com/errata/RHSA-2026:22120 REF https://access.redhat.com/errata/RHSA-2026:22121 REF https://access.redhat.com/errata/RHSA-2026:23262 REF https://access.redhat.com/errata/RHSA-2026:23264 REF https://access.redhat.com/errata/RHSA-2026:33120 REF https://access.redhat.com/errata/RHSA-2026:33123 REF https://access.redhat.com/errata/RHSA-2026:33142 REF https://access.redhat.com/errata/RHSA-2026:33150 REF https://access.redhat.com/errata/RHSA-2026:33574 REF https://access.redhat.com/errata/RHSA-2026:34357 REF https://access.redhat.com/errata/RHSA-2026:34359 REF https://access.redhat.com/errata/RHSA-2026:34364 REF https://access.redhat.com/errata/RHSA-2026:35832 REF https://access.redhat.com/errata/RHSA-2026:35993 REF https://access.redhat.com/errata/RHSA-2026:35994 REF https://access.redhat.com/errata/RHSA-2026:35995 REF https://access.redhat.com/errata/RHSA-2026:36207 REF https://access.redhat.com/errata/RHSA-2026:36319 REF https://access.redhat.com/errata/RHSA-2026:36617 REF https://access.redhat.com/errata/RHSA-2026:36625 REF https://access.redhat.com/errata/RHSA-2026:36648 REF https://access.redhat.com/errata/RHSA-2026:36651 REF https://access.redhat.com/errata/RHSA-2026:36776 REF https://access.redhat.com/errata/RHSA-2026:36796 REF https://access.redhat.com/errata/RHSA-2026:36797 REF https://access.redhat.com/errata/RHSA-2026:38504 REF https://access.redhat.com/errata/RHSA-2026:39266 REF https://access.redhat.com/errata/RHSA-2026:39272 REF https://access.redhat.com/errata/RHSA-2026:39319 REF https://access.redhat.com/errata/RHSA-2026:39573 REF https://access.redhat.com/errata/RHSA-2026:39810 REF https://access.redhat.com/errata/RHSA-2026:40118 REF https://access.redhat.com/errata/RHSA-2026:40119 REF https://access.redhat.com/errata/RHSA-2026:40945 REF https://access.redhat.com/errata/RHSA-2026:41019 REF https://access.redhat.com/errata/RHSA-2026:41030 REF https://access.redhat.com/errata/RHSA-2026:41055 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:42043 REF https://access.redhat.com/errata/RHSA-2026:42047 REF https://access.redhat.com/errata/RHSA-2026:42048 REF https://access.redhat.com/errata/RHSA-2026:42049 REF https://access.redhat.com/errata/RHSA-2026:42050 REF https://access.redhat.com/errata/RHSA-2026:42051 REF https://access.redhat.com/errata/RHSA-2026:42078 REF https://access.redhat.com/errata/RHSA-2026:42079 REF https://access.redhat.com/errata/RHSA-2026:42082 REF https://access.redhat.com/errata/RHSA-2026:42132 REF https://access.redhat.com/errata/RHSA-2026:42150 REF https://access.redhat.com/errata/RHSA-2026:42151 REF https://access.redhat.com/errata/RHSA-2026:42240 REF https://access.redhat.com/errata/RHSA-2026:42644 REF https://access.redhat.com/errata/RHSA-2026:42852 REF https://access.redhat.com/errata/RHSA-2026:42946 REF https://access.redhat.com/errata/RHSA-2026:43038 REF https://access.redhat.com/errata/RHSA-2026:43692 REF https://access.redhat.com/errata/RHSA-2026:44622 REF https://access.redhat.com/errata/RHSA-2026:46885 REF https://access.redhat.com/errata/RHSA-2026:47149 REF https://access.redhat.com/errata/RHSA-2026:47735 REF https://access.redhat.com/errata/RHSA-2026:47952 REF https://access.redhat.com/errata/RHSA-2026:48151 REF https://access.redhat.com/errata/RHSA-2026:49702 REF https://access.redhat.com/errata/RHSA-2026:49703 REF https://access.redhat.com/errata/RHSA-2026:49712 REF https://access.redhat.com/errata/RHSA-2026:50205 REF https://access.redhat.com/errata/RHSA-2026:50300 REF https://access.redhat.com/errata/RHSA-2026:50319 REF https://access.redhat.com/errata/RHSA-2026:50336 REF https://access.redhat.com/errata/RHSA-2026:50843 REF https://access.redhat.com/errata/RHSA-2026:51033 REF https://access.redhat.com/errata/RHSA-2026:51057 REF https://access.redhat.com/errata/RHSA-2026:51187 REF https://access.redhat.com/errata/RHSA-2026:51194 REF https://access.redhat.com/errata/RHSA-2026:51341 REF https://access.redhat.com/errata/RHSA-2026:53412 REF https://access.redhat.com/errata/RHSA-2026:53413 REF https://access.redhat.com/errata/RHSA-2026:53415 REF https://access.redhat.com/errata/RHSA-2026:53530 REF https://access.redhat.com/errata/RHSA-2026:54168 REF https://access.redhat.com/errata/RHSA-2026:54191 REF https://access.redhat.com/errata/RHSA-2026:54274 REF https://access.redhat.com/errata/RHSA-2026:54283 REF https://access.redhat.com/errata/RHSA-2026:54284 REF https://access.redhat.com/errata/RHSA-2026:54285 REF https://access.redhat.com/errata/RHSA-2026:54286 REF https://access.redhat.com/errata/RHSA-2026:54287 REF https://access.redhat.com/errata/RHSA-2026:54435 REF https://access.redhat.com/errata/RHSA-2026:54441 REF https://access.redhat.com/errata/RHSA-2026:54500 REF https://access.redhat.com/errata/RHSA-2026:54552 REF https://access.redhat.com/errata/RHSA-2026:54556 REF https://access.redhat.com/errata/RHSA-2026:54584 REF https://access.redhat.com/errata/RHSA-2026:54602 REF https://access.redhat.com/errata/RHSA-2026:54603 REF https://access.redhat.com/errata/RHSA-2026:54757 REF https://access.redhat.com/errata/RHSA-2026:56340 REF https://access.redhat.com/errata/RHSA-2026:56785 REF https://access.redhat.com/errata/RHSA-2026:56789 REF https://access.redhat.com/errata/RHSA-2026:56790 REF https://access.redhat.com/errata/RHSA-2026:56852 REF https://access.redhat.com/errata/RHSA-2026:56855 REF https://access.redhat.com/errata/RHSA-2026:56910 REF https://access.redhat.com/errata/RHSA-2026:56912 REF https://access.redhat.com/errata/RHSA-2026:56913 REF https://access.redhat.com/errata/RHSA-2026:57191 REF https://access.redhat.com/errata/RHSA-2026:57194 REF https://access.redhat.com/errata/RHSA-2026:57482 REF https://access.redhat.com/errata/RHSA-2026:57488 REF https://access.redhat.com/errata/RHSA-2026:57649 REF https://access.redhat.com/errata/RHSA-2026:59467 REF https://access.redhat.com/errata/RHSA-2026:59559 REF https://access.redhat.com/errata/RHSA-2026:60018 REF https://access.redhat.com/errata/RHSA-2026:60025 REF https://access.redhat.com/errata/RHSA-2026:60302 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:61253 REF https://access.redhat.com/errata/RHSA-2026:61313 REF https://access.redhat.com/errata/RHSA-2026:65126 REF https://access.redhat.com/errata/RHSA-2026:65534 REF https://access.redhat.com/errata/RHSA-2026:65886 REF https://access.redhat.com/errata/RHSA-2026:66022 REF https://access.redhat.com/errata/RHSA-2026:67149 REF https://access.redhat.com/errata/RHSA-2026:67287 REF https://access.redhat.com/errata/RHSA-2026:67319 REF https://access.redhat.com/security/cve/CVE-2026-33811 REF https://bugzilla.redhat.com/show_bug.cgi?id=2467822 REF https://go.dev/cl/767860 REF https://go.dev/issue/78803 REF https://groups.google.com/g/golang-announce/c/qcCIEXso47M REF https://pkg.go.dev/vuln/GO-2026-4981 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy