A double-free vulnerability in the Go standard library net package affects network applications using the cgo DNS resolver, leading to denial of service via application crashes.

This issue involves a double-free memory corruption flaw (CWE-415) triggered by processing excessively long CNAME DNS responses via the cgo DNS resolver, which can be invoked by unauthenticated remote attackers.

A successful exploit against this vulnerability results in application crashes and service disruption, impacting the availability of systems relying on the affected Go net package. With a CVSS score of 7.5, the risk is classified as high due to the potential for unauthenticated remote attackers to induce denial of service conditions without requiring privileges or user interaction.

Immediate Action: Update the Go standard library net package to version 1.25.10, 1.26.3, or later as specified by the vendor advisory.

Proactive Monitoring: Monitor application error logs and system monitoring tools for unexpected crashes, restarts, or memory management exceptions related to DNS resolution.

Compensating Controls: Implement network level restrictions or use a pure Go DNS resolver instead of cgo if feasible to bypass the vulnerable code path until an update can be deployed.

Public Exploit Available: No (No confirmed public exploit in available data)

Given the high severity and potential for unanticipated service interruptions through remote crashes, administrative teams must prioritize updating affected Go environments. Applying the official vendor patches immediately remains the only definitive way to eliminate the underlying memory corruption risk.