Executive brief
A vulnerability in the Go programming language's networking library can cause applications to crash when they attempt to resolve certain domain names. This occurs when a malicious or malformed DNS response contains an excessively long CNAME record, leading to a memory error that terminates the program. This can be used by attackers to cause a denial-of-service, potentially taking down critical web services or internal applications that rely on Go's standard networking features.
Technical details
A double-free vulnerability (CWE-415) exists in the Go standard library 'net' package when using the cgo-based DNS resolver. The flaw is located within the LookupCNAME and Resolver.LookupCNAME functions. When the resolver processes a specially crafted, excessively long CNAME DNS response, it incorrectly manages C memory pointers, leading to a double-free condition and a subsequent process crash. This is a remote attack vector requiring no authentication, as an attacker only needs to control or spoof a DNS response sent to the vulnerable application. The issue is resolved in Go versions 1.25.10 and 1.26.3.
Affected products
- Google Go before 1.25.10, 1.26.0 before 1.26.3
- Red Hat Red Hat Hardened Images 1
- Red Hat Red Hat OpenShift Service Mesh 3.0, 3.1, 3.2, 3.3
Timeline
- 2026-04-16: disclosed: Issue opened on Go GitHub repository
- 2026-05-07: advisory: Go vulnerability report GO-2026-4981 published
- 2026-05-07: patched: Fixes released in Go 1.25.10 and 1.26.3
- 2026-06-04: patched: Red Hat released security advisories for affected products