Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Temporal Server FIPS & NFS Provisioner crash on long CNAME
published 21 days ago
Summary
Both Temporal Server FIPS and the NFS subdirectory provisioner can stop working if they try to look up a DNS CNAME that is unusually long. The overly long response causes the program to free memory twice, which leads to a crash. Update to the latest version that includes the fix, or configure the software to use a non‑cgo DNS resolver until you can apply the update.
What to do
- Update cleanstart temporal-server-fips to version 1.31.4-r1.
- Update cleanstart nfs-subdir-external-provisioner to version 4.0.18-r3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | temporal-server-fips |
< 1.31.4-r1 Fix: upgrade to 1.31.4-r1
|
| CleanStart | cleanstart | nfs-subdir-external-provisioner |
< 4.0.18-r3 Fix: upgrade to 4.0.18-r3
|
Original advisory text
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash
CVE-2026-33811 affects multiple packages. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CLEANSTART-2026-ZA04816 · OSV
Track software like this
Free during beta