CVE-2026-27145

Aliases:GO-2026-5037BIT-golang-2026-27145
Advisory lineage Upstream: 0 Downstream: 30
Awaiting Analysis
Published: 02 Jun 2026, 22:01
Last modified:22 Jul 2026, 12:08

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.9% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

02 Jun 2026, 22:01
Published
Vulnerability first disclosed
22 Jul 2026, 12:08
Last Modified
Vulnerability information updated

Description

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

EPSS Trends

Current EPSS score: 0.90%• Percentile: 55%

Techniques & Countermeasures

  • CWE-606•Unchecked Input for Loop Condition

    The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

Affected Systems

  • go standard library•crypto/x509

    < 1.25.11 | ≥ 1.26.0-0, < 1.26.4

  • Go•stdlib

    ≥ 1.26.0-0, < 1.26.4

References (38)