Go LookupCNAME Double-Free Vulnerability in cgo DNS Resolver

A double-free vulnerability in C memory has been identified in the Go programming language's standard library, specifically within the 'net' package. This issue arises when the 'LookupCNAME' function is used with the cgo DNS resolver, and a very long CNAME response is received. The vulnerability can lead to a crash by triggering a double-free of C memory, causing a memory management error that can be exploited to disrupt the normal operation of a program.

Impact

Exploitation of this vulnerability causes a crash due to a double-free of C memory, leading to a memory management error.

Remediation

Users can upgrade to Go versions 1.26.3 or 1.25.10, both of which include the necessary fix. Instructions for downloading these versions are available on the Go website.