CVE-2026-27145
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
- Score
- CVSS 3.1 7.5 High
- Status
- Undergoing Analysis - security@golang.org
- Published
- 2026-06-02
- Last modified
- 2026-09-18
- Weaknesses
- CWE-606
Affected products
- Cryptox509 (Go Standard Library)
- Acm (Redhat)
- Advanced Cluster Security (Redhat)
- Amq Streams (Redhat)
- Ansible Automation Platform (Redhat)
- Assisted Installer (Redhat)
- Ceph Storage (Redhat)
- Cert Manager (Redhat)
- Cluster Observability Operator (Redhat)
- Confidential Compute Attestation (Redhat)
- Connectivity Link (Redhat)
- Container Native Virtualization (Redhat)
- Cryostat (Redhat)
- Deployment Validator Operator (Redhat)
- Devworkspace (Redhat)
- Edge Manager (Redhat)
- Enterprise Linux (Redhat)
- Enterprise Linux Ai (Redhat)
- Enterprise Linux Eus (Redhat)
- Ext Dns Optr (Redhat)
- External Secrets Operator (Redhat)
- Gatekeeper (Redhat)
- Hummingbird (Redhat)
- Lightspeed For Runtimes (Redhat)
- Logging (Redhat)
- Lvms (Redhat)
- Migration Toolkit Applications (Redhat)
- Mirror Registry (Redhat)
- Multiarch Tuning Operator (Redhat)
- Multicluster Engine (Redhat)
- Multicluster Globalhub (Redhat)
- Network Observ Optr (Redhat)
- Ocp Tools (Redhat)
- Openshift (Redhat)
- Openshift Ai (Redhat)
- Openshift Api Data Protection (Redhat)
- Openshift Builds (Redhat)
- Openshift Cluster Manager Cli (Redhat)
- Openshift Compliance Operator (Redhat)
- Openshift Custom Metrics Autoscaler (Redhat)
- Openshift Data Foundation (Redhat)
- Openshift Devspaces (Redhat)
- Openshift Distributed Tracing (Redhat)
- Openshift File Integrity Operator (Redhat)
- Openshift Gitops (Redhat)
- Openshift Lightspeed (Redhat)
- Openshift Pipelines (Redhat)
- Openshift Power Monitoring (Redhat)
- Openshift Security Profiles Operator (Redhat)
- Openshift Service On Aws (Redhat)
- Openstack (Redhat)
- Quay (Redhat)
- Red Hat 3scale Amp (Redhat)
- Rhdh (Redhat)
- Rhel E4s (Redhat)
- Rhel Els (Redhat)
- Rhel Eus (Redhat)
- Rhmt (Redhat)
- Satellite (Redhat)
- Serverless (Redhat)
- Service Interconnect (Redhat)
- Service Mesh (Redhat)
- Source To Image (Redhat)
- Stf (Redhat)
- Trusted Artifact Signer (Redhat)
- Webterminal (Redhat)
- Windows Machine Config (Redhat)
- Workload Availability Far (Redhat)
- Workload Availability Mdr (Redhat)
- Workload Availability Nhc (Redhat)
- Zero Trust Workload Identity Manager (Redhat)
References
- https://go.dev/cl/783621
- https://go.dev/issue/79694
- https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
- https://pkg.go.dev/vuln/GO-2026-5037
- https://access.redhat.com/errata/RHSA-2026:23262
- https://access.redhat.com/errata/RHSA-2026:23264
- https://access.redhat.com/errata/RHSA-2026:29980
- https://access.redhat.com/errata/RHSA-2026:29981
- https://access.redhat.com/errata/RHSA-2026:33574
- https://access.redhat.com/errata/RHSA-2026:34357
- https://access.redhat.com/errata/RHSA-2026:34359
- https://access.redhat.com/errata/RHSA-2026:35832
- https://access.redhat.com/errata/RHSA-2026:36317
- https://access.redhat.com/errata/RHSA-2026:36648
- https://access.redhat.com/errata/RHSA-2026:36797
- https://access.redhat.com/errata/RHSA-2026:38995
- https://access.redhat.com/errata/RHSA-2026:39005
- https://access.redhat.com/errata/RHSA-2026:39573
- https://access.redhat.com/errata/RHSA-2026:39879
- https://access.redhat.com/errata/RHSA-2026:41030
- https://access.redhat.com/errata/RHSA-2026:41036
- https://access.redhat.com/errata/RHSA-2026:41930
- https://access.redhat.com/errata/RHSA-2026:42043
- https://access.redhat.com/errata/RHSA-2026:42047
- https://access.redhat.com/errata/RHSA-2026:42049
- https://access.redhat.com/errata/RHSA-2026:42050
- https://access.redhat.com/errata/RHSA-2026:42051
- https://access.redhat.com/errata/RHSA-2026:42079
- https://access.redhat.com/errata/RHSA-2026:42080
- https://access.redhat.com/errata/RHSA-2026:42082
