Double free in Go programming language - CVE-2026-33811

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU140611

Double free in Go programming language - CVE-2026-33811

Published: July 31, 2026


Vulnerability identifier: #VU140611
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33811
CWE-ID: CWE-415
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to double free in net.LookupCNAME and Resolver.LookupCNAME when processing a very long CNAME response with the cgo DNS resolver. A remote attacker can send a specially crafted DNS response to cause a denial of service.


Affected software

Go programming language
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
rhc-worker-playbook (Red Hat package)
rhc (Red Hat package)
golang-github-openprinting-ipp-usb (Red Hat package)
butane (Red Hat package)
runc (Red Hat package)
oci-seccomp-bpf-hook (Red Hat package)
containernetworking-plugins (Red Hat package)
skopeo (Red Hat package)
golang-misc
golang-src
golang-shared
golang-docs
golang-bin
golang
golang-tests
delve (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
ignition (Red Hat package)
git-lfs (Red Hat package)
git-lfs
git-lfs-doc
ose-aws-ecr-image-credential-provider (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
ose-gcp-gcr-image-credential-provider (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
Red Hat OpenShift GitOps
Red Hat OpenShift Container Platform

How to mitigate CVE-2026-33811

Install security update from vendor's website.

Go programming language - addressed in versions 1.25.10, 1.26.3
rhc-worker-playbook (Red Hat package) - addressed in versions 0.2.3-6.el10_0, 0.2.10-1.el10_2
rhc (Red Hat package) - update to 0.3.2-6.el10_0
golang-github-openprinting-ipp-usb (Red Hat package) - update to 0.9.27-7.el10_2.2
butane (Red Hat package) - addressed in versions 0.19.0-5.rhaos4.14.el8, 0.20.0-6.rhaos4.15.el8, 0.21.0-6.rhaos4.16.el8, 0.23.0-5.rhaos4.18.el8
runc (Red Hat package) - addressed in versions 1.2.9-5.rhaos4.16.el8, 1.2.9-5.rhaos4.16.el9, 1.2.9-7.rhaos4.18.el8, 1.2.9-7.rhaos4.18.el9
oci-seccomp-bpf-hook (Red Hat package) - update to 1.2.11-2.el9_8
containernetworking-plugins (Red Hat package) - addressed in versions 1.4.0-7.rhaos4.14.el8, 1.4.0-7.rhaos4.15.el8, 1.4.0-10.rhaos4.16.el8, 1.4.0-10.rhaos4.18.el8
skopeo (Red Hat package) - addressed in versions 1.11.3-8.rhaos4.14.el8, 1.11.3-8.rhaos4.14.el9, 1.11.3-9.rhaos4.15.el8, 1.11.3-10.rhaos4.15.el9, 1.14.5-8.rhaos4.16.el8, 1.14.5-8.rhaos4.16.el9, 1.16.1-6.rhaos4.18.el8, 1.16.1-7.rhaos4.18.el9
Red Hat OpenShift GitOps - update to 1.21.1
golang-misc - update to 1.25.9-5
golang-src - update to 1.25.9-5
golang-shared - update to 1.25.9-5
golang-docs - update to 1.25.9-5
golang-bin - update to 1.25.9-5
golang - update to 1.25.9-5
golang-tests - update to 1.25.9-5
delve (Red Hat package) - update to 1.26.1-1.el10_0
cri-tools (Red Hat package) - addressed in versions 1.27.0-8.el8, 1.27.0-8.el9, 1.28.0-9.el8, 1.28.0-9.el9, 1.29.0-8.el8, 1.29.0-8.el9, 1.31.1-7.el8, 1.31.1-7.el9
cri-o (Red Hat package) - addressed in versions 1.27.8-19.rhaos4.14.gitcea2db1.el8, 1.27.8-19.rhaos4.14.gitcea2db1.el9, 1.28.11-14.rhaos4.15.gitf722b2f.el8, 1.28.11-14.rhaos4.15.gitf722b2f.el9, 1.29.13-12.rhaos4.16.git979a5e6.el8, 1.29.13-12.rhaos4.16.git979a5e6.el9, 1.31.13-11.rhaos4.18.git817a650.el9, 1.31.13-12.rhaos4.18.git249255c.el8
ignition (Red Hat package) - addressed in versions 2.18.0-8.rhaos4.16.el9, 2.18.0-11.rhaos4.18.el9
git-lfs (Red Hat package) - addressed in versions 3.4.1-12.el8_10, 3.7.1-4.el9_8.2, 3.7.1-5.el10_2.6
git-lfs - update to 3.4.1-12.0.1
git-lfs-doc - update to 3.4.1-12.0.1
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.14.0-202608131802.p2.g9a7820e.assembly.stream.el8, 4.14.0-202608131802.p2.g9a7820e.assembly.stream.el9, 4.15.0-202608131733.p2.gfd77d92.assembly.stream.el8, 4.15.0-202608131733.p2.gfd77d92.assembly.stream.el9, 4.16.0-202608111505.p2.ga53e9de.assembly.stream.el8, 4.16.0-202608111505.p2.ga53e9de.assembly.stream.el9, 4.18.0-202608121933.p2.gc395190.assembly.stream.el8, 4.18.0-202608121933.p2.gc395190.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.14.0-202608131802.p2.g44b3ac2.assembly.stream.el8, 4.14.0-202608131802.p2.g44b3ac2.assembly.stream.el9, 4.15.0-202608131733.p2.g8231637.assembly.stream.el8, 4.15.0-202608131733.p2.g8231637.assembly.stream.el9, 4.16.0-202608111505.p2.g6f88b58.assembly.stream.el8, 4.16.0-202608111505.p2.g6f88b58.assembly.stream.el9, 4.18.0-202608132034.p2.g6febe61.assembly.stream.el8, 4.18.0-202608132034.p2.g6febe61.assembly.stream.el9
openshift (Red Hat package) - addressed in versions 4.14.0-202608131802.p2.g288be6b.assembly.stream.el8, 4.14.0-202608131802.p2.g288be6b.assembly.stream.el9, 4.15.0-202608131733.p2.g5cb2ef4.assembly.stream.el8, 4.15.0-202608131733.p2.g5cb2ef4.assembly.stream.el9, 4.16.0-202608111505.p2.g41c4e9b.assembly.stream.el8, 4.16.0-202608111505.p2.g41c4e9b.assembly.stream.el9, 4.18.0-202608132034.p2.g91c2408.assembly.stream.el8, 4.18.0-202608132034.p2.g91c2408.assembly.stream.el9
Red Hat OpenShift Container Platform - addressed in versions 4.14.72, 4.15.68, 4.16.69, 4.18.54
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.15.0-202608131733.p2.g5638728.assembly.stream.el8, 4.15.0-202608131733.p2.g5638728.assembly.stream.el9, 4.16.0-202608111505.p2.ga3ebdc0.assembly.stream.el8, 4.16.0-202608111505.p2.ga3ebdc0.assembly.stream.el9, 4.18.0-202608121933.p2.g9795abd.assembly.stream.el8, 4.18.0-202608121933.p2.g9795abd.assembly.stream.el9
ose-gcp-gcr-image-credential-provider (Red Hat package) - addressed in versions 4.15.0-202608131733.p2.gfc50272.assembly.stream.el8, 4.15.0-202608131733.p2.gfc50272.assembly.stream.el9, 4.16.0-202608111505.p2.g26b43df.assembly.stream.el8, 4.16.0-202608111505.p2.g26b43df.assembly.stream.el9, 4.18.0-202608121933.p2.g6ea2356.assembly.stream.el8, 4.18.0-202608121933.p2.g6ea2356.assembly.stream.el9
kernel (Red Hat package) - update to 5.14.0-284.188.1.el9_2
kernel-rt (Red Hat package) - update to 5.14.0-284.188.1.rt14.473.el9_2

External References

Related Security Bulletins