CVE-2026-27145
Inefficient candidate hostname parsing in crypto/x509
CVSS Score
6.5
EPSS Score
0.9%
EPSS Percentile
57th
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
| Vendor | go standard library |
| Product | crypto/x509 |
| Published | Jun 2, 2026 |
| Last Updated | Jul 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for go standard library crypto/x509
Be the first to know when new medium vulnerabilities affecting go standard library crypto/x509 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Go standard library / crypto/x509
0 < 1.25.11 1.26.0-0 < 1.26.4
References
go.dev: https://go.dev/cl/783621 go.dev: https://go.dev/issue/79694 groups.google.com: https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw pkg.go.dev: https://pkg.go.dev/vuln/GO-2026-5037 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-27145 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2484207 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42079 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42080 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42082 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42150 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42151 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42240 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:35832 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34357 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:39005 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42946 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:39573 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:38995 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41930 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:29981 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34359 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:39879 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36317 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41030 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42142 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33574 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:23262 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:23264 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42644 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36648 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41036 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36797 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42043 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42047 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42050 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42051 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42049
Credits
Jakub Ciolek - https://ciolek.dev/