CVE-2026-33811: Crash when handling long CNAME response in net
Crash when handling long CNAME response in net
Other sources
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.25.10-r0 - Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.3-r0 - Upgrade
Upgrade
alpine/rcloneto a version that resolves this vulnerability.Fixed in 1.74.1-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33811?
CVE-2026-33811 is classified as a high severity vulnerability due to its potential to cause application crashes.
How do I fix CVE-2026-33811?
To fix CVE-2026-33811, upgrade to the latest version of the Google Go net package that addresses this issue.
What causes CVE-2026-33811?
CVE-2026-33811 is caused by a double-free of C memory when handling excessively long CNAME responses using the cgo DNS resolver.
Which versions of the Google Go net package are affected by CVE-2026-33811?
Versions of the Google Go net package prior to the security update that addresses CVE-2026-33811 are affected.
What kind of impact does CVE-2026-33811 have on applications?
CVE-2026-33811 can lead to application crashes, resulting in potential downtime and disruption of service.