CVE-2026-33811 describes a denial of service vulnerability in the Go net package's LookupCNAME function when used with the cgo DNS resolver. Specifically, a very long CNAME response can trigger a double-free of C memory, causing the application to crash. This vulnerability affects Red Hat Satellite 6.18 and 6.19 running on Red Hat Enterprise Linux 9 x86_64. Red Hat has issued security advisories (RHSA-2026:42151 and RHSA-2026:42240) that include updated yggdrasil-worker-forwarder packages which fix this issue. The CVSS vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and an impact limited to availability (denial of service).

Successful exploitation of this vulnerability results in a denial of service condition due to application crash caused by double-free memory errors. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

Red Hat has released updated packages for Red Hat Satellite 6.18 and 6.19 that address this vulnerability. Users should apply these official security updates as per Red Hat's advisories RHSA-2026:42151 and RHSA-2026:42240. Before applying these updates, ensure all previously released errata relevant to the system have been applied. Patch status is confirmed as available via these vendor advisories.