CVE-2026-33811

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-415CWE-1341

Affected software

VendorProductVersions
Go standard librarynet< 1.25.10; >= 1.26.0-0, < 1.26.3
Red HatCryostat 4 on RHEL 9—
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8—
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8—
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 9—
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 9—
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 10—
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 9—
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 9—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat OpenShift Container Platform 4.14—
Red HatRed Hat OpenShift Container Platform 4.14—
Red HatRed Hat OpenShift Container Platform 4.14—
Red HatRed Hat OpenShift Container Platform 4.14—
Red HatRed Hat OpenShift Container Platform 4.15—
Red HatRed Hat OpenShift Container Platform 4.15—
Red HatRed Hat OpenShift Container Platform 4.15—
Red HatRed Hat OpenShift Container Platform 4.15—
Red HatRed Hat OpenShift Container Platform 4.15—
Red HatRed Hat OpenShift Container Platform 4.15—

References

Timeline

Published
May 7, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-338126.1Parsing a malicious font file can cause excessive memory allocation.CVE-2026-338137.5Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.CVE-2026-338147.5When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FCVE-2026-338159.8Memory-safety vulnerability in github.com/jackc/pgx/v5.CVE-2026-338169.8Memory-safety vulnerability in github.com/jackc/pgx/v5.CVE-2026-338187.5Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.CVE-2026-338199.8Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.CVE-2026-33825.5A security flaw has been discovered in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::Boxed_Number::get_as of the CVE-2026-338219.9Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a networkCVE-2026-338226.1Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-338236.5Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.CVE-2026-338249.8Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.