When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
Weakness
The product calls free() twice on the same memory address.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Go | Golang | * | 1.25.10 (excluding) |
| Go | Golang | 1.26.0 (including) | 1.26.3 (excluding) |
| Red Hat Hardened Images | RedHat | golang1-25-main-1.25.11-2.hum1 | * |
| Red Hat Hardened Images | RedHat | golang1-26-main-1.26.4-2.hum1 | * |
| Golang-1.10 | Ubuntu | esm-infra/xenial | * |
| Golang-1.13 | Ubuntu | esm-apps/xenial | * |
| Golang-1.18 | Ubuntu | esm-apps/xenial | * |
| Golang-1.6 | Ubuntu | esm-infra/xenial | * |