PT-2026-45873 · Go+2 · Go+2
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Go versions prior to 1.25-1.25.11-1.1
Go versions prior to 1.26-1.26.4-1.1
Description
Inefficient candidate hostname parsing occurs in the
crypto/x509 package. The (*x509.Certificate).VerifyHostname function previously called matchHostnames() in a loop over all DNS Subject Alternative Name (SAN) entries, causing strings.Split(host, ".") to execute repeatedly on the same input hostname. When a large DNS SAN list is present, verification costs scale quadratically based on the number of SAN entries multiplied by the hostname's label count. This overhead occurs even for untrusted certificates because x509.Verify validates hostnames before building the certificate chain.Recommendations
Update to version 1.25-1.25.11-1.1.
Update to version 1.26-1.26.4-1.1.
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Go
Red Os
Rocky Linux