Description
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
References (4)
Core 4
Scores
CVSS v3
7.5
EPSS
0.0002
EPSS Percentile
4.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-415
Status
published
Products (3)
Go standard library/net
< 1.25.10
Go standard library/net
1.26.0-0 - 1.26.3
golang/go
< 1.25.10
Published
May 07, 2026
Tracked Since
May 08, 2026