net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

Go-Get-RCE-CVE-2018-6574-POC

CVE-2018-6574 POC LINK https://nvd.nist.gov/vuln/detail/CVE-2018-6574 http://blog.nsfocus.net/cve-2018-6574/ RUN go get github.com/neargle/CVE-2018-6574-POC DETAIL payload at: https://github.com/neargle/CVE-2018-6574-POC/blob/master/calc.cL10 Now it supports all platforms using CGO features. Afte...

CVE-2024-24787-PoC

CVE-2024-24787-PoC On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -ltolibrary flag in a "cgo LDFLAGS" directive. This is not my bug, I just made a PoC for it. Reference...

CVE-2018-6574

CVE-2018-6574 Steps to reproduce: 1. Create a .c file containing the malicious command revshell: include include static void malicious attributeconstructor; void malicious system""; 2. Compile it using GCC. You must compile it on the exact architecture and OS as the target e.g. Linux x8664: gcc...

CVE-2018-6574

CVE-2018-6574 POC Exploit POC For CVE-2018-6574 Compile 1. Create an exploit file with the following: include include static void malicious attributeconstructor; void malicious system"COMMAND"; 2. Compile it: gcc -shared -o exploit.so -fPIC exploit.c 3. Finally, you need the go code that will tel...

CVE-2018-6574

CVE-2018-6574 Exploit for remote command execution in Golang go get command. Introduction When you go get a package, Go is designed to build and install the package without running any code from it. The intent is that you can safely get, build, and even install Go packages without trusting them a...

CLEANSTART-2026-TS93212 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

Security vulnerability affects the argo-cd package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

Astra Linux - Vulnerability in Golang-1.19

The “//line” directive can be used to bypass the restrictions on the “//go:cgo” directives, allowing for the passing of blocked linker and compiler flags during compilation. This can lead to the execution of arbitrary code when running “go build”. The “//line” directive requires the absolute path...

Astra Linux – Vulnerability in Golang-1.19

The go command may execute arbitrary code during compilation when using cgo. This can occur when running “go get” on a malicious module, or when running any other command that compiles unauthorized code. This issue can be triggered by linker flags, specified via the cgo LDFLAGS directive. The...

Astra Linux – Vulnerability in Golang-1.19

The go command may generate unexpected code during build time when using cgo. This can lead to unexpected behavior when running a Go program that uses cgo. This issue may occur when running a trusted module that contains directories with newline characters in their names. Modules retrieved using...

CLEANSTART-2026-IU25622 mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS

Security vulnerability affects the mongodb package. The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS...

CLEANSTART-2026-ZA04816 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

CVE-2026-33811 affects multiple packages. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. See references for individual vulnerability details...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2026-4323)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.CVE-2026-42499 If a trusted template...

CLEANSTART-2026-AY85890 discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary

Security vulnerability affects the victoria-metrics package. A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary...

CLEANSTART-2026-EU28747 mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS

Security vulnerability affects the external-secrets-operator-fips package. The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS...

CLEANSTART-2026-AC13048 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

CVE-2026-33811 affects multiple packages. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. See references for individual vulnerability details...

CLEANSTART-2026-TG48757 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

Security vulnerability affects the temporal-server package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

CLEANSTART-2026-CA40991 mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS

CVE-2026-2303 affects multiple packages. The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS. See references for individual vulnerability details...