CVE-2025-58187: Quadratic complexity when checking name constraints in crypto/x509

Analyzed

AliasesSUSE-SU-2025:3681-1UBUNTU-CVE-2025-58187DEBIAN-CVE-2025-58187+4378 more

Published 29-10-2025Last modified 20-11-2025

Vulnerability summary

CVE-2025-58187 is a high (CVSS 7.5) Inefficient Algorithmic Complexity vulnerability in go standard library crypto/x509. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.9% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.41%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 23 · Related 105

MGASA-2025-0256 OPENSUSE-SU-2025:15608-1 OPENSUSE-SU-2025:15609-1 OPENSUSE-SU-2025:15695-1 OPENSUSE-SU-2025:15711-1 OPENSUSE-SU-2025:15723-1+94 more

Showing 100 of 106.

Timeline

29-10-2025
PublishedVulnerability first disclosed.
20-11-2025
Last modifiedVulnerability information updated.

Description

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.41%

Chance of exploitation in the next 30 days

Percentile

35%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.41% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

age< 1.2.1-r8
age-fips< 1.2.1-r8
amass< 5.0.1-r1
amazon-cloudwatch-agent-operator-fips< 3.3.0-r1
amazon-cloudwatch-agent-operator-fips-compat< 3.3.0-r1

amazon-eks-ami-fips< 20251023-r0
amazon-k8s-cni-fips< 1.20.4-r2
amazon-k8s-cni-init-fips< 1.20.4-r2
amazon-k8s-cni-init-fips-compat< 1.20.4-r2
amazon-ssm-agent< 3.3.3270.0-r1
amazon-ssm-agent-ecs-exec< 3.3.3270.0-r1
ansible-operator< 1.41.0-r1
ansible-operator-compat< 1.41.0-r1
apisix-ingress-controller< 1.8.4-r4
apisix-ingress-controller-compat< 1.8.4-r4
apisix-ingress-controller-iamguarded-compat< 1.8.4-r4
apm-server-7.17< 7.17.29-r4
apm-server-7.17-compat< 7.17.29-r4
apm-server-8.17< 8.17.10-r2
apm-server-8.17-compat< 8.17.10-r2
apm-server-8.18< 8.18.8-r1
apm-server-8.18-compat< 8.18.8-r1
apm-server-fips-7.17< 7.17.29-r4
apm-server-fips-7.17-compat< 7.17.29-r4
apm-server-fips-8.17< 8.17.10-r1
apm-server-fips-8.17-compat< 8.17.10-r1
apm-server-fips-8.18< 8.18.8-r1
apm-server-fips-8.18-compat< 8.18.8-r1
apm-server-fips-9.0< 9.0.8-r1
apm-server-fips-9.0-compat< 9.0.8-r1
argo-cd-2.13-compat< 2.13.9-r2
argo-rollouts< 1.8.3-r4
argo-rollouts-fips< 1.8.3-r5
atlantis< 0.36.0-r2
auditbeat-7< 7.17.29-r4
auditbeat-7-oci-entrypoint< 7.17.29-r4
auditbeat-8.17< 8.17.10-r2
auditbeat-8.17-oci-entrypoint< 8.17.10-r2
auditbeat-8.18< 8.18.8-r2
auditbeat-8.18-oci-entrypoint< 8.18.8-r2
auditbeat-9.0< 9.0.8-r2
auditbeat-9.0-oci-entrypoint< 9.0.8-r2
auditbeat-fips-8.17< 8.17.10-r2
auditbeat-fips-8.18< 8.18.8-r2
auditbeat-fips-9.0< 9.0.8-r2
authservice-fips< 1.1.1-r1
authservice-fips-compat< 1.1.1-r1
aws-eks-pod-identity-agent-fips< 0.1.35-r1
aws-iam-authenticator< 0.7.8-r1
aws-iam-authenticator-fips< 0.7.8-r1
aws-node-termination-handler< 1.25.2-r2
aws-node-termination-handler-compat< 1.25.2-r2
aws-node-termination-handler-fips< 1.25.2-r2
aws-node-termination-handler-fips-compat< 1.25.2-r2
aws-privateca-issuer-compat-fips< 1.7.0-r3
aws-privateca-issuer-fips< 1.7.0-r3
aws-s3-controller< 1.1.1-r1
aws-signer-notation-plugin< 1.0.2292-r3
aws-signer-notation-plugin-fips< 1.0.2292-r3
aws-sigv4-proxy< 1.10-r3
aws-sigv4-proxy-compat< 1.10-r3
aws-sigv4-proxy-fips< 1.10-r3
aws-sigv4-proxy-fips-compat< 1.10-r3
azure-aad-pod-identity-mic< 1.8.17-r28
azure-aad-pod-identity-nmi< 1.8.17-r28
azure-container-networking< 1.7.4-r1
azure-ipam< 0.4.0-r4
azure-ipam-dropgz< 0.4.0-r4
azure-vnet-cni< 1.7.4-r1
azure-workload-identity-webhook< 1.5.1-r3
azure-workload-identity-webhook-compat< 1.5.1-r3
azuredisk-csi-fips-1.33< 1.33.5-r1
azurefile-csi-1.30< 1.30.10-r5
azurefile-csi-1.30-compat< 1.30.10-r5
azurefile-csi-1.31< 1.31.8-r1
azurefile-csi-1.31-compat< 1.31.8-r1
azurefile-csi-1.32< 1.32.7-r1
azurefile-csi-1.32-compat< 1.32.7-r1
azurefile-csi-1.33< 1.33.5-r1
azurefile-csi-1.33-compat< 1.33.5-r1
azurefile-csi-fips-1.29< 1.29.12-r5
azurefile-csi-fips-1.29-compat< 1.29.12-r5
azurefile-csi-fips-1.30< 1.30.10-r5
azurefile-csi-fips-1.30-compat< 1.30.10-r5
azurefile-csi-fips-1.31< 1.31.8-r1
azurefile-csi-fips-1.31-compat< 1.31.8-r1
azurefile-csi-fips-1.32< 1.32.7-r1
azurefile-csi-fips-1.32-compat< 1.32.7-r1
bank-vaults< 1.32.0-r2
bank-vaults-template< 1.32.0-r2
bazelisk< 1.27.0-r1
bazelisk-default< 1.27.0-r1
beats-7< 7.17.29-r4
beats-8.17< 8.17.10-r2
beats-8.18< 8.18.8-r2
beats-9.0< 9.0.8-r2
beats-fips-8.17< 8.17.10-r2
beats-fips-8.18< 8.18.8-r2
beats-fips-9.0< 9.0.8-r2
blob-csi-1.23< 1.23.11-r56
blob-csi-1.23-compat< 1.23.11-r56
blob-csi-1.24< 1.24.11-r5
blob-csi-1.24-compat< 1.24.11-r5
blob-csi-1.25< 1.25.10-r1
blob-csi-1.25-compat< 1.25.10-r1
blob-csi-fips-1.23< 1.23.11-r57
blob-csi-fips-1.23-compat< 1.23.11-r57
blob-csi-fips-1.24< 1.24.11-r5
blob-csi-fips-1.24-compat< 1.24.11-r5
blob-csi-fips-1.25< 1.25.10-r1
blob-csi-fips-1.25-compat< 1.25.10-r1
blob-csi-fips-1.26< 1.26.7-r3
blob-csi-fips-1.26-compat< 1.26.7-r3
blobfuse2-fips< 2.4.2-r6
blobfuse2-fips-health-monitor< 2.4.2-r6
blobfuse2-fips-syslog< 2.4.2-r6
bom< 0.7.1-r1
boring-registry< 0.16.6-r2
boring-registry-fips< 0.16.6-r2
buildctl< 0.25.1-r1
buildkitd< 0.25.1-r1
cadvisor< 0.53.0-r6
cadvisor-compat< 0.53.0-r6
calico-3.29< 3.29.6-r1
calico-apiserver-3.29< 3.29.6-r1
calico-apiserver-compat-3.29< 3.29.6-r1
calico-app-policy-3.29< 3.29.6-r1
calico-cni-3.29< 3.29.6-r1
calico-cni-compat-3.29< 3.29.6-r1
calico-felix-3.29< 3.29.6-r1
calico-key-cert-provisioner-3.29< 3.29.6-r1
calico-kube-controllers-3.29< 3.29.6-r1
calico-node-3.29< 3.29.6-r1
calico-pod2daemon-3.29< 3.29.6-r1
calico-pod2daemon-flexvol-compat-3.29< 3.29.6-r1
calico-typha-client-3.29< 3.29.6-r1
calico-typhad-3.29< 3.29.6-r1
calicoctl-3.29< 3.29.6-r1
capslock< 0.2.8-r1
cargobump< 0.1.0-r7
cephcsi-fips< 3.15.0-r3
cert-exporter< 2.16.0-r2
cert-exporter-fips< 2.16.0-r3
cert-manager-cmctl< 2.3.0-r5
cert-manager-webhook-pdns< 2.5.3-r1
cert-manager-webhook-pdns-fips< 2.5.3-r2
certificate-transparency< 1.3.2-r4
certificate-transparency-trillian-ctserver< 1.3.2-r4
cfssl< 1.6.5-r23
cfssl-bundle< 1.6.5-r23
cfssl-bundle-fips< 1.6.5-r16
cfssl-certinfo< 1.6.5-r23
cfssl-certinfo-fips< 1.6.5-r16
cfssl-fips< 1.6.5-r16
cfssl-json< 1.6.5-r23
cfssl-json-fips< 1.6.5-r16
cfssl-mkbundle< 1.6.5-r23
cfssl-mkbundle-fips< 1.6.5-r16
cfssl-multirootca< 1.6.5-r23
cfssl-multirootca-fips< 1.6.5-r16
cfssl-newkey< 1.6.5-r23
cfssl-newkey-fips< 1.6.5-r16
cfssl-scan< 1.6.5-r23
cfssl-scan-fips< 1.6.5-r16
chart-testing< 3.14.0-r1
chartmuseum< 0.16.3-r8
chartmuseum-fips< 0.16.3-r6
checksec< 3.0.2-r6
chisel< 1.11.3-r1
chisel-compat< 1.11.3-r1
chisel-fips< 1.11.3-r1
cilium-1.15< 1.15.19-r3
cilium-1.15-clustermesh-apiserver< 1.15.19-r3
cilium-1.15-container-init< 1.15.19-r3
cilium-1.15-container-init-compat< 1.15.19-r3
cilium-1.15-hubble-relay< 1.15.19-r3
cilium-1.15-iptables< 1.15.19-r3
cilium-1.15-operator-aws< 1.15.19-r3
cilium-1.15-operator-generic< 1.15.19-r3
cilium-certgen-0.2< 0.2.4-r3
cilium-envoy-fips-1.15< 1.15.19-r6
cilium-fips-1.15< 1.15.19-r7
cilium-fips-1.15-clustermesh-apiserver< 1.15.19-r7
cilium-fips-1.15-container-init< 1.15.19-r7
cilium-fips-1.15-container-init-compat< 1.15.19-r7
cilium-fips-1.15-host-utils< 1.15.19-r7
cilium-fips-1.15-hubble-relay< 1.15.19-r7
cilium-fips-1.15-operator-aws< 1.15.19-r7
cilium-fips-1.15-operator-azure< 1.15.19-r7
cilium-fips-1.15-operator-generic< 1.15.19-r7
cis-operator-1.2< 1.2.7-r5
cloud-provider-aws-1.28< 1.28.11-r40
cloud-provider-aws-1.28-cloud-controller-manager< 1.28.11-r40
cloud-provider-aws-1.28-ecr-credential-provider< 1.28.11-r40
cloud-provider-aws-1.29< 1.29.8-r40
cloud-provider-aws-1.29-cloud-controller-manager< 1.29.8-r40
cloud-provider-aws-1.29-ecr-credential-provider< 1.29.8-r40
cloud-provider-aws-fips-1.28< 1.28.11-r11
cloud-provider-aws-fips-1.28-cloud-controller-manager< 1.28.11-r11

Show all 199

Alpine1 product

go≥ 1.25.0, < 1.24.8-r0 | ≥ 1.25.0, < 1.25.2-r0

2 vendors · 200 products · Showing 200 of 2629

References

19 links

go.dev/issue/75681WEBREPORTIssue Tracking
go.dev/cl/709854WEBFIXPatch
groups.google.com/g/golang-announce/c/4Emdl2iQ_bIWEBMailing ListRelease Notes
pkg.go.dev/vuln/GO-2025-4007WEBVendor Advisory
www.openwall.com/lists/oss-security/2025/10/08/1WEBMailing ListRelease Notes
www.suse.com/support/update/announcement/2025/suse-su-20253681-1/Advisory
bugzilla.suse.com/1244485REPORT
www.suse.com/security/cve/CVE-2025-58187WEB
ubuntu.com/security/CVE-2025-58187REPORT
www.cve.org/CVERecord?id=CVE-2025-58187REPORT

Show all 19 references