The vulnerability CVE-2026-33811 in the Go standard library net package occurs when the LookupCNAME function is used with the cgo DNS resolver. A very long CNAME DNS response can trigger a double-free of C memory, causing a crash and denial of service. This is classified as CWE-415 (Double Free). The issue affects Go version 1.26.0-0. Red Hat advisories reference this vulnerability and include it in security updates for their Ansible Automation Platform 2.6. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service).

Successful exploitation of this vulnerability results in a denial of service due to a crash caused by double-free of memory. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported. The vulnerability can be triggered remotely without authentication or user interaction.

Red Hat has released security advisories and updates addressing this vulnerability in their Ansible Automation Platform 2.6 packages. Users should apply the relevant security updates provided by Red Hat to remediate this issue. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the Red Hat advisories linked for the latest remediation guidance. No vendor advisory states that no action is required or that the issue is already mitigated.