This vulnerability in the Go net package arises from a double-free memory error triggered by a very long CNAME response when using the LookupCNAME function with the cgo DNS resolver. The flaw allows a remote attacker to cause a crash of the affected application, resulting in a denial of service. The issue is specific to applications using the cgo DNS resolver. The vendor advisory recommends mitigating the issue by configuring applications to use the pure Go DNS resolver instead, via the environment variable GODEBUG=netdns=go. This mitigation requires restarting the affected applications. The vulnerability has a CVSS v3.1 base score of 7.5, indicating high severity, with no impact on confidentiality or integrity but a high impact on availability.

A remote attacker can cause a denial of service by triggering a double-free memory error through a very long CNAME DNS response. This leads to a crash of the vulnerable application, impacting service availability. There is no confidentiality or integrity impact reported.

A fix is available via configuration change: applications should be configured to use the pure Go DNS resolver instead of the cgo DNS resolver by setting the environment variable GODEBUG=netdns=go. This mitigation requires restarting affected applications or services. Users should verify that this change does not negatively affect DNS resolution in their environment. No official patch is explicitly stated in the advisory, but this configuration change effectively mitigates the vulnerability.