CVE-2025-61727

Description

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.28%• Percentile: 21%

Techniques & Countermeasures

• CWE-295•Improper Certificate Validation

  The product does not validate, or incorrectly validates, a certificate.

Affected Systems

• chainguard•actions-runner-controller-fips

  < 0.13.0-r4

• chainguard•actions-runner-controller-fips-compat

  < 0.13.0-r4

• chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips

  < 1.300062.0-r2

• chainguard•amazon-cloudwatch-agent-config-downloader-fips

  < 1.300062.0-r2

• chainguard•amazon-cloudwatch-agent-config-translator-fips

  < 1.300062.0-r2

• chainguard•amazon-cloudwatch-agent-fips

  < 1.300062.0-r2

• chainguard•amazon-cloudwatch-agent-operator-fips

  < 3.3.0-r3

• chainguard•amazon-cloudwatch-agent-operator-fips-compat

  < 3.3.0-r3

• chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips

  < 1.300062.0-r2

• chainguard•amazon-vpc-cni-plugins-fips

  < 1.3_git20251112-r2

• chainguard•apm-server-fips-8.17

  < 8.17.10-r3

• chainguard•apm-server-fips-8.17-compat

  < 8.17.10-r3

• chainguard•apm-server-fips-8.18

  < 8.18.8-r2

• chainguard•apm-server-fips-8.18-compat

  < 8.18.8-r2

• chainguard•argo-cd-fips-3.0

  < 3.0.20-r7

• chainguard•argo-cd-fips-3.0-compat

  < 3.0.20-r7

• chainguard•argo-cd-fips-3.0-iamguarded-compat

  < 3.0.20-r7

• chainguard•argo-cd-fips-3.0-repo-server

  < 3.0.20-r7

• chainguard•argo-cd-fips-3.2

  < 3.2.1-r1

• chainguard•argo-cd-fips-3.2-compat

  < 3.2.1-r1

• chainguard•argo-cd-fips-3.2-iamguarded-compat

  < 3.2.1-r1

• chainguard•argo-rollouts-fips

  < 1.8.3-r7

• chainguard•auditbeat-7

  < 7.17.29-r7

• chainguard•authservice-fips

  < 1.1.4-r1

• chainguard•authservice-fips-compat

  < 1.1.4-r1

• chainguard•aws-application-networking-k8s-fips

  < 1.1.7-r2

• chainguard•aws-application-networking-k8s-fips-compat

  < 1.1.7-r2

• chainguard•aws-ebs-csi-driver-fips-1.49

  < 1.49.2-r1

• chainguard•aws-ebs-csi-driver-fips-1.50

  < 1.50.3-r1

• chainguard•aws-ebs-csi-driver-fips-1.53

  < 1.53.0-r1

• chainguard•aws-efs-csi-driver-fips

  < 2.1.15-r1

• chainguard•aws-eks-pod-identity-agent-fips

  < 0.1.36-r1

• chainguard•aws-flb-cloudwatch-compat-fips

  < 1.9.4-r15

• chainguard•aws-flb-cloudwatch-fips

  < 1.9.4-r15

• chainguard•aws-flb-firehose-compat-fips

  < 1.7.2-r16

• chainguard•aws-flb-firehose-fips

  < 1.7.2-r16

• chainguard•aws-iam-authenticator-fips

  < 0.7.9-r1

• chainguard•aws-load-balancer-controller-fips

  < 2.16.0-r2

• chainguard•aws-nuke-fips

  < 3.62.0-r1

• chainguard•aws-privateca-issuer-compat-fips

  < 1.7.1-r1

• chainguard•aws-privateca-issuer-fips

  < 1.7.1-r1

• chainguard•aws-signer-notation-plugin-fips

  < 1.0.2292-r4

• chainguard•aws-sigv4-proxy-fips

  < 1.10-r4

• chainguard•azure-service-operator-fips

  < 2.17.0-r0

• chainguard•azuredisk-csi-fips-1.31

  < 1.31.12-r5

• chainguard•azuredisk-csi-fips-1.32

  < 1.32.11-r5

• chainguard•azurefile-csi-fips-1.30

  < 1.30.10-r9

• chainguard•azurefile-csi-fips-1.32

  < 1.32.8-r2

• chainguard•azurefile-csi-fips-1.32-compat

  < 1.32.8-r2

• chainguard•bank-vaults-fips

  < 1.20.4-r35

Showing first 50 affected entries in server-rendered view.

References (15)

• https://go.dev/cl/723900
• https://go.dev/issue/76442
• https://groups.google.com/g/golang-announce/c/8FJoBkPddm4
• https://pkg.go.dev/vuln/GO-2025-4175
• https://access.redhat.com/errata/RHSA-2026:7070
• https://images.redhat.com/
• https://access.redhat.com/security/cve/CVE-2025-61727
• https://access.redhat.com/security/updates/classification/
• https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7070.json
• https://bugzilla.redhat.com/show_bug.cgi?id=2418677
• https://www.cve.org/CVERecord?id=CVE-2025-61727
• https://nvd.nist.gov/vuln/detail/CVE-2025-61727
• https://security-tracker.debian.org/tracker/CVE-2025-61727
• https://pkg.go.dev
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61727.json