7.5
High
CVE-2026-32281 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a…
Description
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| crypto/x509 1.26 | 1.26.0-0 → < 1.26.2 | 1.26.2 |
| crypto/x509 1.25 | earliest → < 1.25.9 | 1.25.9 |
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of crypto/x509
The 15 CVEs of crypto/x509 →
CVE-2026-111943
On most platforms, Go uses the given system root certificates
6.8
Medium
CVE-2026-27145
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name…
6.5
Medium
CVE-2026-32280
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate…
7.5
High
CVE-2026-33810
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to…
7.5
High