CVE-2026-33811

HighCVSS 7.5/10Last modified Sep 18, 2026

Description

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-415CWE-1341

Affected software

No affected versions have been published.

Timeline

Published
May 7, 2026
Last modified
Sep 18, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-338126.1Parsing a malicious font file can cause excessive memory allocation.CVE-2026-338137.5Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.CVE-2026-338147.5When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FCVE-2026-338159.8Memory-safety vulnerability in github.com/jackc/pgx/v5.CVE-2026-338169.8Memory-safety vulnerability in github.com/jackc/pgx/v5.CVE-2026-338187.5Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.CVE-2026-338199.8Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.CVE-2026-33825.5A security flaw has been discovered in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::Boxed_Number::get_as of the CVE-2026-338219.9Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a networkCVE-2026-338226.1Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-338236.5Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.CVE-2026-338249.8Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
CVE-2026-33811: High severity, CVSS 7.5 | Vulnix