Skip to content
fr Sign in
6.5 Medium

CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name…

Description

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

Affected products and versions

Product Affected versions Fixed in
crypto/x509 1.26 1.26.0-0 → < 1.26.4 1.26.4
crypto/x509 1.25 earliest → < 1.25.11 1.25.11
Assisted Installer for Red Hat OpenShift Container Platform 2 Versions not published
Builds for Red Hat OpenShift Versions not published
cert-manager Operator for Red Hat OpenShift Versions not published
Compliance Operator Versions not published
Confidential Compute Attestation Versions not published
Deployment Validation Operator Versions not published
External Secrets Operator for Red Hat OpenShift Versions not published
Show the 159 other branches
Product Affected versions Fixed in
Fence Agents Remediation Operator Versions not published
File Integrity Operator Versions not published
Machine Deletion Remediation Operator Versions not published
Migration Toolkit for Containers Versions not published
Multiarch Tuning Operator Versions not published
Multicluster Global Hub Versions not published
Network Observability Operator Versions not published
Node HealthCheck Operator Versions not published
OpenShift API for Data Protection Versions not published
OpenShift Lightspeed Versions not published
OpenShift Pipelines Versions not published
OpenShift Serverless Versions not published
OpenShift Service Mesh 2 Versions not published
OpenShift Service Mesh 3 Versions not published
OpenShift Source-to-Image (S2I) Versions not published
Power monitoring for Red Hat OpenShift Versions not published
Red Hat 3scale API Management Platform 2 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Ceph Storage 5 Versions not published
Red Hat Ceph Storage 6 Versions not published
Red Hat Connectivity Link 1 Versions not published
Red Hat Developer Hub Versions not published
Red Hat Edge Manager 1 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat Hardened Images 1.26 earliest → < 1.26.4-2.hum1 1.26.4-2.hum1
Red Hat Lightspeed for Runtimes Operator Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Cluster Manager CLI Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenShift Dev Workspaces Operator Versions not published
Red Hat OpenShift on AWS Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat OpenStack Platform 16.2 Versions not published
Red Hat OpenStack Platform 17.1 Versions not published
Red Hat OpenStack Platform 18.0 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Trusted Artifact Signer Versions not published
Red Hat Web Terminal Versions not published
Security Profiles Operator Versions not published
streams for Apache Kafka 2 Versions not published
streams for Apache Kafka 3 Versions not published
Zero Trust Workload Identity Manager Versions not published
Zero Trust Workload Identity Manager - Tech Preview Versions not published
Cryostat 4 Versions not published
Custom Metric Autoscaler operator for Red Hat Openshift Versions not published
Gatekeeper 3 Versions not published
Logging Subsystem for Red Hat OpenShift Versions not published
Logical Volume Manager Storage Versions not published
Migration Toolkit for Applications 8 Versions not published
mirror registry for Red Hat OpenShift 2 Versions not published
Multicluster Engine for Kubernetes Versions not published
OpenShift Developer Tools and Services Versions not published
Red Hat Advanced Cluster Security 4 Versions not published
Red Hat Ceph Storage 7 Versions not published
Red Hat Ceph Storage 8 Versions not published
Red Hat Ceph Storage 9 Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat OpenShift distributed tracing 3 Versions not published
Red Hat OpenShift for Windows Containers Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat Quay 3 Versions not published
Red Hat Service Interconnect 2 Versions not published
Service Telemetry Framework 1.5 Versions not published
Red Hat Developer Hub 1.9 1782767215 earliest → < 1782767215 1782767215
Red Hat Enterprise Linux AppStream (v. 10) Versions not published
Red Hat Enterprise Linux AppStream (v. 9) Versions not published
Red Hat OpenShift Builds 1.7.4 1783057868 earliest → < 1783057868 1783057868
Red Hat Trusted Artifact Signer 1.4 4 earliest → < 4-1.4.2 4-1.4.2
Red Hat Enterprise Linux AppStream (v. 8) Versions not published
Multicluster Global Hub 1.4.5 1784061472 earliest → < 1784061472 1784061472
Red Hat OpenShift Builds 1.8.1 1783612119 earliest → < 1783612119 1783612119
Red Hat multicluster global hub 1.4.3 1784061472 earliest → < 1784061472 1784061472
Red Hat OpenShift Builds 1.7.1 1783057868 earliest → < 1783057868 1783057868
Red Hat Ansible Automation Platform 2.6 for RHEL 10 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.7 for RHEL 10 Versions not published
Red Hat Ansible Automation Platform 2.7 for RHEL 9 Versions not published
Red Hat Satellite 6.16 for RHEL 8 Versions not published
Red Hat Satellite 6.16 for RHEL 9 Versions not published
Red Hat Satellite 6.17 for RHEL 9 Versions not published
Red Hat Satellite 6.18 for RHEL 9 Versions not published
Red Hat Satellite 6.19 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.7 1783917963 earliest → < 1783917963 1783917963
Red Hat OpenShift AI 2.25 1784004914 earliest → < 1784004914 1784004914
Red Hat Web Terminal 1.11 1784296203 earliest → < 1784296203 1784296203
Red Hat Web Terminal 1.12 1784247610 earliest → < 1784247610 1784247610
Red Hat Web Terminal 1.13 1784296127 earliest → < 1784296127 1784296127
Red Hat Web Terminal 1.14 1784296114 earliest → < 1784296114 1784296114
Red Hat Web Terminal 1.15 1784296033 earliest → < 1784296033 1784296033
Multicluster Global Hub 1.6.2 1784152046 earliest → < 1784152046 1784152046
Red Hat OpenShift Builds 1.8.0 1783612119 earliest → < 1783612119 1783612119
multicluster engine for Kubernetes 2.8 1787259113 earliest → < 1787259113 1787259113
Multicluster Global Hub 1.7.2 1785775948 earliest → < 1785775948 1785775948
Multicluster Global Hub 1.7.2 1784768332 earliest → < 1784768332 1784768332
Red Hat Advanced Cluster Management for Kubernetes 2.13 1787263693 earliest → < 1787263693 1787263693
Multicluster Global Hub 1.7.0 1785775948 earliest → < 1785775948 1785775948
Multicluster Global Hub 1.7.0 1784768332 earliest → < 1784768332 1784768332
Red Hat multicluster global hub 1.4.2 1784061472 earliest → < 1784061472 1784061472
Red Hat multicluster global hub 1.6.0 1784152046 earliest → < 1784152046 1784152046
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Multicluster Global Hub 1.7.1 1784768332 earliest → < 1784768332 1784768332
Red Hat multicluster global hub 1.4.4 1784061472 earliest → < 1784061472 1784061472
Red Hat OpenShift Builds 1.7.3 1783057868 earliest → < 1783057868 1783057868
Red Hat OpenShift Service Mesh 3.0 1784917979 earliest → < 1784917979 1784917979
Red Hat OpenShift Service Mesh 3.2 1784918117 earliest → < 1784918117 1784918117
Red Hat OpenShift Service Mesh 3.4 1785317214 earliest → < 1785317214 1785317214
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat OpenShift distributed tracing 3.10.1 1785704547 earliest → < 1785704547 1785704547
Red Hat OpenShift Service Mesh 3.1 1784918113 earliest → < 1784918113 1784918113
Red Hat OpenShift Service Mesh 3.3 1785316150 earliest → < 1785316150 1785316150
OpenShift Developer Tools and Services 1.6.3 1784728036 earliest → < 1784728036 1784728036
OpenShift Developer Tools and Services 1.6.2 1784728036 earliest → < 1784728036 1784728036
Red Hat OpenShift distributed tracing 3.10.2 1785704547 earliest → < 1785704547 1785704547
Multicluster Global Hub 1.8.1 1785763319 earliest → < 1785763319 1785763319
Red Hat Enterprise Linux 7 Extended Lifecycle Support Versions not published
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.6 Extended Update Support Versions not published
Streams for Apache Kafka 3.2.1 Versions not published
Cert Manager support for Red Hat OpenShift release 1.19 1786613805 earliest → < 1786613805 1786613805
external secrets operator for Red Hat OpenShift 1.1 1786614676 earliest → < 1786614676 1786614676
multicluster engine for Kubernetes 2.10 1787176886 earliest → < 1787176886 1787176886
Multicluster Global Hub 1.6.5 1784152046 earliest → < 1784152046 1784152046
OpenShift Compliance Operator 1 1786380082 earliest → < 1786380082 1786380082
Red Hat Advanced Cluster Management for Kubernetes 2.15 1786549537 earliest → < 1786549537 1786549537
Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 1786483782 earliest → < 1786483782 1786483782
Compliance Operator 1 1786380082 earliest → < 1786380082 1786380082
multicluster engine for Kubernetes 2.1 1787176886 earliest → < 1787176886 1787176886
Multicluster Global Hub 1.8.0 1785763319 earliest → < 1785763319 1785763319
Red Hat OpenShift distributed tracing 3.10.0 1785704547 earliest → < 1785704547 1785704547
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Versions not published
Red Hat OpenShift Container Platform 4.18 1786754425 earliest → < 1786754425 1786754425
multicluster engine for Kubernetes 2.11 1787239595 earliest → < 1787239595 1787239595
multicluster engine for Kubernetes 2.17 1786664288 earliest → < 1786664288 1786664288
multicluster engine for Kubernetes 2.6 1787260821 earliest → < 1787260821 1787260821
multicluster engine for Kubernetes 2.9 1787176716 earliest → < 1787176716 1787176716
Red Hat Advanced Cluster Management for Kubernetes 2.17 1788105072 earliest → < 1788105072 1788105072
Red Hat OpenShift Container Platform 4.21 1786526139 earliest → < 1786526139 1786526139
Red Hat Web Terminal 1.16 1786654871 earliest → < 1786654871 1786654871
Red Hat Advanced Cluster Management for Kubernetes 2.11 1787263584 earliest → < 1787263584 1787263584
Red Hat Advanced Cluster Management for Kubernetes 2.14 1787170830 earliest → < 1787170830 1787170830
Red Hat Advanced Cluster Management for Kubernetes 2.16 1787242321 earliest → < 1787242321 1787242321
Cluster Observability Operator 1.5.2 1787593946 earliest → < 1787593946 1787593946
Cluster Observability Operator 1.5.0 1787593946 earliest → < 1787593946 1787593946
OpenShift Developer Tools and Services 1.6.0 1784728036 earliest → < 1784728036 1784728036
Red Hat Lightspeed (formerly Insights) for Runtimes 1 1786483782 earliest → < 1786483782 1786483782
Red Hat OpenShift Container Platform 4.17 1787554347 earliest → < 1787554347 1787554347
ExternalDNS Operator Versions not published
OpenShift API for Data Protection 1.5 1788860461 earliest → < 1788860461 1788860461
RHEM 1.1 for RHEL 10 Versions not published
RHEM 1.1 for RHEL 9 Versions not published
RHEM 1.2 for RHEL 10 Versions not published
RHEM 1.2 for RHEL 9 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of crypto/x509

The 15 CVEs of crypto/x509 →
CVE-2026-111943 On most platforms, Go uses the given system root certificates 6.8 Medium CVE-2026-32280 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate… 7.5 High CVE-2026-32281 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a… 7.5 High CVE-2026-33810 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to… 7.5 High
Track this CVE