The vulnerability is a double‑free in the Go standard library’s net package that occurs when LookupCNAME uses the cgo DNS resolver to process an unusually long CNAME response. This memory corruption leads to an application crash, causing a denial of service.

Affected systems include any Go environment that uses the net package with the cgo DNS resolver. All current Go releases that have not applied the fix are vulnerable; specific affected versions are not listed in the advisory.

The exploit does not provide remote code execution but can be leveraged by an attacker who controls a DNS server to supply a long CNAME chain that crashes the process. The CVSS score of 7.5 indicates a high severity, and the EPSS score indicates a very low exploitation probability (<1%). The vulnerability is not listed in CISA KEV, indicating it has not been broadly exploited yet. Nevertheless, the crash can degrade availability, so applying the vendor patch remains the primary risk mitigation.