CVE-2026-27145
Medium · 6.5CVSS
6.5
EPSS
0.6%
Published
Jun 2, 2026
CISA due date
—
The record
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | go1.25 | 0 | 1.25.11-160000.1.1 |
| openSUSE:Leap 16.0 | go1.26 | 0 | 1.26.4-160000.1.1 |
| openSUSE:Tumbleweed | go1.25 | 0 | 1.25.11-1.1 |
| openSUSE:Tumbleweed | go1.26 | 0 | 1.26.4-1.1 |
| openSUSE:Tumbleweed | rclone | 0 | 1.74.3-1.1 |
Related vulnerabilities
- CVE-2026-42507 When returning errors, functions in the net/textproto package would include its input as… Also affects go1.25
- CVE-2026-42504 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can… Also affects go1.25
- CVE-2026-27144 The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op… Also affects go1.25
- CVE-2026-27143 Arithmetic over induction variables in loops were not correctly checked for underflow or… Also affects go1.25
- CVE-2026-32282 On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod… Also affects go1.25
- CVE-2026-32280 During chain building, the amount of work that is done is not correctly limited when a… Also affects go1.25
- CVE-2026-32281 Validating certificate chains which use policies is unexpectedly inefficient when… Also affects go1.25
- CVE-2026-32283 If one side of the TLS connection sends multiple key update messages post-handshake in a… Also affects go1.25