CLEANSTART-2026-SU88447: When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

Q: What conditions are required for exploitation?

The affected application must use LookupCNAME with the cgo DNS resolver and process a very long CNAME response. Exploitation does not require privileges or user interaction and can be performed remotely.

Q: What is the practical impact?

A successful attack can trigger a double-free of C memory and crash the affected process, resulting in a denial of service. The supplied severity vector indicates no confidentiality or integrity impact.

Q: Which deployments are most exposed?

Deployments are exposed when argo-workflows invokes LookupCNAME through the cgo DNS resolver and an attacker can cause it to receive a very long CNAME response. The provided data does not state whether this resolver configuration is enabled by default.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-33811

Frequently Asked Questions

What conditions are required for exploitation?

The affected application must use LookupCNAME with the cgo DNS resolver and process a very long CNAME response. Exploitation does not require privileges or user interaction and can be performed remotely.

What is the practical impact?

A successful attack can trigger a double-free of C memory and crash the affected process, resulting in a denial of service. The supplied severity vector indicates no confidentiality or integrity impact.

Which deployments are most exposed?

Deployments are exposed when argo-workflows invokes LookupCNAME through the cgo DNS resolver and an attacker can cause it to receive a very long CNAME response. The provided data does not state whether this resolver configuration is enabled by default.

CLEANSTART-2026-SU88447: When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required for exploitation?

What is the practical impact?

Which deployments are most exposed?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the practical impact?

Which deployments are most exposed?