Fluid Attacks Database

Description

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	golang-1.15	=1.15.15-1 \|\| =1.15.15-1~deb11u1 \|\| =1.15.15-1~deb11u2 \|\| =1.15.15-1~deb11u3 \|\| =1.15.15-1~deb11u4 \|\| =1.15.15-2 \|\| =1.15.15-3 \|\| =1.15.15-4 \|\| =1.15.15-5 \|\| =1.15.9-6	-
debian 14	golang-1.25	=1.25.0-1 \|\| =1.25.0-2 \|\| =1.25.1-1 \|\| =1.25.10-1~bpo13+1 \|\| =1.25.2-1 \|\| =1.25.3-1 \|\| =1.25.6-1 \|\| =1.25.7-1 \|\| =1.25.7-2 \|\| =1.25.8-1 \|\| =1.25.9-1 \|\| >=0 <1.25.10-1	1.25.10-1
rpm rhel10	golang	<0:1.26.3-4.el10_2	0:1.26.3-4.el10_2
rpm rhel10	trustee	-	-
rpm rhel10	bootc-image-builder	-	-
rpm rhel9	bootc-image-builder	-	-
rpm rhel9	butane	-	-
rpm rhel10	git-lfs	<0:3.7.1-5.el10_2.6	0:3.7.1-5.el10_2.6
rpm rhel9	git-lfs	<0:3.7.1-4.el9_8.2	0:3.7.1-4.el9_8.2
rpm rhel10	go-fdo-client	-	-

1-10 of 50

Aliases

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.