CVE-2025-61727: Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

Analyzed

AliasesRHSA-2026:7070UBUNTU-CVE-2025-61727DEBIAN-CVE-2025-61727+2324 more

Published 03-12-2025Last modified 03-12-2025

Vulnerability summary

CVE-2025-61727 is a medium (CVSS 6.5) Improper Certificate Validation vulnerability in go standard library crypto/x509. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 23.2% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.30%

0%100%

Low · +0.02 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 23 · Related 183

MGASA-2025-0326 OPENSUSE-SU-2025:15795-1 OPENSUSE-SU-2025:15796-1 OPENSUSE-SU-2025:15807-1 OPENSUSE-SU-2025:15817-1 OPENSUSE-SU-2025:20157-1+94 more

Showing 100 of 184.

Timeline

03-12-2025
PublishedVulnerability first disclosed.
03-12-2025
Last modifiedVulnerability information updated.

Description

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

CVSS metrics

8 scores · 8 sources · 1 version

v3.16.5

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

23%

Versus all other CVEs

30-day change

Increase +0.02 pp

From 0.28% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

actions-runner-controller-fips< 0.13.0-r4
actions-runner-controller-fips-compat< 0.13.0-r4
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips< 1.300062.0-r2
amazon-cloudwatch-agent-config-downloader-fips< 1.300062.0-r2
amazon-cloudwatch-agent-config-translator-fips< 1.300062.0-r2

amazon-cloudwatch-agent-fips< 1.300062.0-r2
amazon-cloudwatch-agent-operator-fips< 3.3.0-r3
amazon-cloudwatch-agent-operator-fips-compat< 3.3.0-r3
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips< 1.300062.0-r2
amazon-vpc-cni-plugins-fips< 1.3_git20251112-r2
apm-server-fips-8.17< 8.17.10-r3
apm-server-fips-8.17-compat< 8.17.10-r3
apm-server-fips-8.18< 8.18.8-r2
apm-server-fips-8.18-compat< 8.18.8-r2
argo-cd-fips-3.0< 3.0.20-r7
argo-cd-fips-3.0-compat< 3.0.20-r7
argo-cd-fips-3.0-iamguarded-compat< 3.0.20-r7
argo-cd-fips-3.0-repo-server< 3.0.20-r7
argo-cd-fips-3.2< 3.2.1-r1
argo-cd-fips-3.2-compat< 3.2.1-r1
argo-cd-fips-3.2-iamguarded-compat< 3.2.1-r1
argo-rollouts-fips< 1.8.3-r7
auditbeat-7< 7.17.29-r7
authservice-fips< 1.1.4-r1
authservice-fips-compat< 1.1.4-r1
aws-application-networking-k8s-fips< 1.1.7-r2
aws-application-networking-k8s-fips-compat< 1.1.7-r2
aws-ebs-csi-driver-fips-1.49< 1.49.2-r1
aws-ebs-csi-driver-fips-1.50< 1.50.3-r1
aws-ebs-csi-driver-fips-1.53< 1.53.0-r1
aws-efs-csi-driver-fips< 2.1.15-r1
aws-eks-pod-identity-agent-fips< 0.1.36-r1
aws-flb-cloudwatch-compat-fips< 1.9.4-r15
aws-flb-cloudwatch-fips< 1.9.4-r15
aws-flb-firehose-compat-fips< 1.7.2-r16
aws-flb-firehose-fips< 1.7.2-r16
aws-iam-authenticator-fips< 0.7.9-r1
aws-load-balancer-controller-fips< 2.16.0-r2
aws-nuke-fips< 3.62.0-r1
aws-privateca-issuer-compat-fips< 1.7.1-r1
aws-privateca-issuer-fips< 1.7.1-r1
aws-signer-notation-plugin-fips< 1.0.2292-r4
aws-sigv4-proxy-fips< 1.10-r4
azure-service-operator-fips< 2.17.0-r0
azuredisk-csi-fips-1.31< 1.31.12-r5
azuredisk-csi-fips-1.32< 1.32.11-r5
azurefile-csi-fips-1.30< 1.30.10-r9
azurefile-csi-fips-1.32< 1.32.8-r2
azurefile-csi-fips-1.32-compat< 1.32.8-r2
bank-vaults-fips< 1.20.4-r35
bank-vaults-template-fips< 1.20.4-r35
boring-registry-fips< 0.16.6-r4
cass-operator-compat-fips< 1.28.0-r3
cass-operator-fips< 1.28.0-r3
ceph-csi-operator-compat-fips< 0.4.1-r1
ceph-csi-operator-fips< 0.4.1-r1
cert-exporter-fips< 2.17.0-r2
cert-manager-acmesolver-fips-1.18< 1.18.3-r2
cert-manager-cainjector-fips-1.18< 1.18.3-r2
cert-manager-controller-fips-1.18< 1.18.3-r2
cert-manager-csi-driver-fips< 0.12.0-r0 | < 0.11.1-r4
cert-manager-fips-1.17< 1.17.4-r5
cert-manager-fips-1.18< 1.18.4-r0 | < 1.18.3-r2
cert-manager-google-cas-issuer-fips< 0.10.1-r2
cert-manager-startupapicheck-fips-1.18< 1.18.3-r2
cert-manager-webhook-fips-1.18< 1.18.4-r0 | < 1.18.3-r2
cert-manager-webhook-pdns< 2.5.3-r3
cfssl-bundle-fips< 1.6.5-r18
cfssl-certinfo-fips< 1.6.5-r18
cfssl-fips< 1.6.5-r18
cfssl-json-fips< 1.6.5-r18
cfssl-mkbundle-fips< 1.6.5-r18
cfssl-multirootca-fips< 1.6.5-r18
cfssl-newkey-fips< 1.6.5-r18
cfssl-scan-fips< 1.6.5-r18
chartmuseum-fips< 0.16.3-r10
chisel< 1.11.3-r3
chisel-compat< 1.11.3-r3
chisel-fips< 1.11.3-r3
cilium-envoy-fips-1.15< 1.15.19-r7
cilium-envoy-fips-1.16< 1.16.17-r1
cilium-envoy-fips-1.17< 1.17.10-r1
cilium-envoy-fips-1.18< 1.18.4-r1
cinder-csi-plugin-fips< 1.34.1-r2
cloud-provider-aws-fips-1.34< 1.34.1-r3
cloud-provider-aws-fips-1.34-cloud-controller-manager< 1.34.1-r3
cloud-provider-aws-fips-1.34-ecr-credential-provider< 1.34.1-r3
cloud-provider-azure-cloud-controller-manager-fips-1.27< 1.27.21-r16
cloud-provider-azure-cloud-controller-manager-fips-1.29< 1.29.15-r6
cloud-provider-azure-cloud-controller-manager-fips-1.30< 1.30.15-r3
cloud-provider-azure-cloud-controller-manager-fips-1.31< 1.31.12-r2
cloud-provider-azure-cloud-controller-manager-fips-1.33< 1.33.6-r1
cloud-provider-azure-cloud-controller-manager-fips-1.34< 1.34.3-r2
cloud-provider-azure-cloud-node-manager-fips-1.27< 1.27.21-r16
cloud-provider-azure-cloud-node-manager-fips-1.29< 1.29.15-r6
cloud-provider-azure-cloud-node-manager-fips-1.30< 1.30.15-r3
cloud-provider-azure-cloud-node-manager-fips-1.31< 1.31.12-r2
cloud-provider-azure-cloud-node-manager-fips-1.33< 1.33.6-r1
cloud-provider-azure-cloud-node-manager-fips-1.34< 1.34.3-r2
cloud-provider-azure-fips-1.29< 1.29.15-r6
cloud-provider-azure-fips-1.31< 1.31.12-r2
cloud-provider-azure-fips-1.34< 1.34.3-r2
cloudbeat-fips-8.17< 8.17.10-r6
cloudbeat-fips-8.18< 8.18.8-r5
cloudbeat-fips-8.19< 8.19.8-r1
cloudbeat-fips-9.1< 9.1.8-r1
cloudnative-pg-fips< 1.27.1-r3
cloudprober-fips< 0.14.1-r4
cluster-api-aws-controller-fips< 2.10.0-r1
cluster-api-aws-controller-fips-compat< 2.10.0-r1
cluster-api-fips-1.11< 1.11.3-r2
cluster-api-fips-1.11-capd-manager< 1.11.3-r2
cluster-api-fips-1.11-capd-manager-compat< 1.11.3-r2
cluster-api-fips-1.11-clusterctl< 1.11.3-r2
cluster-api-fips-1.11-clusterctl-compat< 1.11.3-r2
cluster-api-fips-1.11-controller< 1.11.3-r2
cluster-api-fips-1.11-kubeadm-bootstrap-controller< 1.11.3-r2
cluster-api-fips-1.11-kubeadm-bootstrap-controller-compat< 1.11.3-r2
cluster-api-fips-1.11-kubeadm-control-plane-controller< 1.11.3-r2
cluster-api-gcp-controller-fips< 1.10.0-r6
cluster-autoscaler-fips-1.31< 1.31.5-r3
cluster-autoscaler-fips-1.31-compat< 1.31.5-r3
cluster-autoscaler-fips-1.32< 1.32.5-r1
cluster-proportional-autoscaler-fips< 1.10.2-r8
configmap-reload-fips< 0.15.0-r5
configmap-reload-fips-0.11< 0.11.1-r21
configmap-reload-fips-0.12< 0.12.0-r20
conftest-fips< 0.65.0-r1
consul-1.20< 1.20.6-r9
consul-1.20-oci-entrypoint< 1.20.6-r9
consul-1.20-oci-entrypoint-compat< 1.20.6-r9
consul-1.21< 1.21.5-r4
consul-1.21-oci-entrypoint< 1.21.5-r4
consul-1.21-oci-entrypoint-compat< 1.21.5-r4
consul-1.22< 1.22.1-r1
consul-1.22-oci-entrypoint< 1.22.1-r1
consul-1.22-oci-entrypoint-compat< 1.22.1-r1
consul-fips-1.19< 1.19.2-r44
consul-fips-1.19-oci-entrypoint< 1.19.2-r44
consul-fips-1.19-oci-entrypoint-compat< 1.19.2-r44
consul-k8s-fips-1.3< 1.3.9-r21
consul-k8s-fips-1.3-cli< 1.3.9-r21
consul-k8s-fips-1.4< 1.4.10-r9
consul-k8s-fips-1.4-cli< 1.4.10-r9
consul-k8s-fips-1.5< 1.5.9-r9
consul-k8s-fips-1.5-cli< 1.5.9-r9
consul-k8s-fips-1.6< 1.6.10-r4
consul-k8s-fips-1.6-cli< 1.6.10-r4
contour-fips-1.30< 1.30.5-r2
contour-fips-1.30-iamguarded-compat< 1.30.5-r2
contour-fips-1.31< 1.31.2-r2
contour-fips-1.32< 1.32.1-r2
contour-fips-1.32-iamguarded-compat< 1.32.1-r2
coredns-fips-1.12< 1.12.4-r6
coredns-fips-1.13< 1.13.1-r3
crossplane-aws-provider-compat-fips< 0.56.0-r3
crossplane-aws-provider-fips< 0.56.0-r3
crossplane-fips-1.20< 1.20.4-r1
crossplane-fips-1.20-crank< 1.20.4-r1
crossplane-fips-2.0< 2.0.6-r1
crossplane-fips-2.0-crank< 2.0.6-r1
crossplane-function-environment-configs-compat-fips< 0.5.0-r1
crossplane-function-environment-configs-fips< 0.5.0-r1
crossplane-provider-gitlab-compat-fips< 0.14.0-r1
crossplane-provider-gitlab-fips< 0.14.0-r1
crossplane-provider-sql-fips< 0.13.0-r3
crossplane-provider-terraform-fips< 1.0.3-r2
cue-fips< 0.15.1-r1
cue-fips-bash-completion< 0.15.1-r1
cue-fips-fish-completion< 0.15.1-r1
cue-fips-zsh-completion< 0.15.1-r1
custom-pod-autoscaler-fips< 2.12.2-r4
custom-pod-autoscaler-operator-fips< 1.4.2-r5
dataplaneapi-fips< 3.2.7-r1
deck-fips< 1.54.0-r1
deck-fips-compat< 1.54.0-r1
dex-fips< 2.44.0-r6
dex-fips-iamguarded-compat< 2.44.0-r6
distribution-fips< 3.0.0-r19
docker-credential-acr-env-fips< 0.7.0-r11
dragonfly-operator-fips< 1.3.1-r1
dragonfly-operator-fips-compat< 1.3.1-r1
dynamic-localpv-provisioner-fips< 4.4.0-r2
eck-operator-fips< 3.2.0-r3
eks-distro-coredns-fips-1.31< 1.31.37-r0
eks-distro-coredns-fips-1.32< 1.32.30-r0
eks-distro-fips-1.31< 1.31.37-r0
eks-distro-fips-1.32< 1.32.30-r0
eks-distro-kube-apiserver-fips-1.31< 1.31.37-r0
eks-distro-kube-apiserver-fips-1.32< 1.32.30-r0
eks-distro-kube-controller-manager-fips-1.31< 1.31.37-r0
eks-distro-kube-controller-manager-fips-1.32< 1.32.30-r0
eks-distro-kube-proxy-fips-1.31< 1.31.37-r0
eks-distro-kube-proxy-fips-1.32< 1.32.30-r0
eks-distro-kube-scheduler-fips-1.31< 1.31.37-r0
eks-distro-kube-scheduler-fips-1.32< 1.32.30-r0
etcd-3.4< 3.4.45-r0
etcd-fips-3.4< 3.4.45-r0

Show all 198

Alpine2 products

docker< 29.1.2-r0
go≥ 1.25, < 1.24.11-r0 | ≥ 1.25, < 1.25.5-r0

2 vendors · 200 products · Showing 200 of 1191

References

19 links

go.dev/cl/723900ARTICLEWEBFIXPatch
go.dev/issue/76442ARTICLEWEBREPORTIssue Tracking
groups.google.com/g/golang-announce/c/8FJoBkPddm4ARTICLEREPORTWEBMailing ListRelease Notes
pkg.go.dev/vuln/GO-2025-4175AdvisoryWEBVendor Advisory
access.redhat.com/errata/RHSA-2026:7070Advisory
images.redhat.comARTICLE
access.redhat.com/security/cve/CVE-2025-61727REPORT
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7070.jsonAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2418677REPORT

Show all 19 references

www.cve.org/CVERecord?id=CVE-2025-61727AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2025-61727Advisory
ubuntu.com/security/CVE-2025-61727REPORT
github.com/golang/go/issues/76442REPORT
security-tracker.debian.org/tracker/CVE-2025-61727Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61727.jsonAdvisory
www.suse.com/security/cve/CVE-2025-61727WEB
security.alpinelinux.org/vuln/CVE-2025-61727Advisory