CVE-2026-32280
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
- Score
- CVSS 3.1 7.5 High
- Status
- Modified - security@golang.org
- Published
- 2026-04-08
- Last modified
- 2026-09-18
- Weaknesses
- CWE-770
Affected products
- Cryptox509 (Go Standard Library)
- Go (Golang)
- Acm (Redhat)
- Advanced Cluster Security (Redhat)
- Ai Inference Server (Redhat)
- Amq Streams (Redhat)
- Ansible Automation Platform (Redhat)
- Apache Camel Hawtio (Redhat)
- Assisted Installer (Redhat)
- Cert Manager (Redhat)
- Certifications (Redhat)
- Confidential Compute Attestation (Redhat)
- Connectivity Link (Redhat)
- Container Native Virtualization (Redhat)
- Cryostat (Redhat)
- Deployment Validator Operator (Redhat)
- Devworkspace (Redhat)
- Edge Manager (Redhat)
- Enterprise Linux (Redhat)
- Enterprise Linux Ai (Redhat)
- Enterprise Linux Eus (Redhat)
- Ext Dns Optr (Redhat)
- External Secrets Operator (Redhat)
- Gatekeeper (Redhat)
- Hummingbird (Redhat)
- Lightspeed For Runtimes (Redhat)
- Logging (Redhat)
- Lvms (Redhat)
- Migration Toolkit Applications (Redhat)
- Mirror Registry (Redhat)
- Multicluster Engine (Redhat)
- Multicluster Globalhub (Redhat)
- Network Observ Optr (Redhat)
- Ocp Tools (Redhat)
- Openshift (Redhat)
- Openshift Ai (Redhat)
- Openshift Api Data Protection (Redhat)
- Openshift Builds (Redhat)
- Openshift Cluster Manager Cli (Redhat)
- Openshift Compliance Operator (Redhat)
- Openshift Custom Metrics Autoscaler (Redhat)
- Openshift Data Foundation (Redhat)
- Openshift Devspaces (Redhat)
- Openshift Distributed Tracing (Redhat)
- Openshift File Integrity Operator (Redhat)
- Openshift Gitops (Redhat)
- Openshift Lightspeed (Redhat)
- Openshift Pipelines (Redhat)
- Openshift Power Monitoring (Redhat)
- Openshift Security Profiles Operator (Redhat)
- Openshift Service On Aws (Redhat)
- Openstack (Redhat)
- Quay (Redhat)
- Red Hat 3scale Amp (Redhat)
- Rhdh (Redhat)
- Rhel Aus (Redhat)
- Rhel E4s (Redhat)
- Rhel Els (Redhat)
- Rhel Eus (Redhat)
- Rhel Eus Long Life (Redhat)
- Rhel Tus (Redhat)
- Rhmt (Redhat)
- Satellite (Redhat)
- Serverless (Redhat)
- Service Interconnect (Redhat)
- Service Mesh (Redhat)
- Stf (Redhat)
- Trusted Artifact Signer (Redhat)
- Webterminal (Redhat)
- Windows Machine Config (Redhat)
- Workload Availability Far (Redhat)
- Workload Availability Mdr (Redhat)
- Workload Availability Nhc (Redhat)
- Zero Trust Workload Identity Manager (Redhat)
References
- https://go.dev/cl/758320
- https://go.dev/issue/78282
- https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
- https://pkg.go.dev/vuln/GO-2026-4947
- https://access.redhat.com/errata/RHSA-2026:10217
- https://access.redhat.com/errata/RHSA-2026:10219
- https://access.redhat.com/errata/RHSA-2026:10704
- https://access.redhat.com/errata/RHSA-2026:11507
- https://access.redhat.com/errata/RHSA-2026:11514
- https://access.redhat.com/errata/RHSA-2026:11688
- https://access.redhat.com/errata/RHSA-2026:13545
- https://access.redhat.com/errata/RHSA-2026:13791
- https://access.redhat.com/errata/RHSA-2026:13826
- https://access.redhat.com/errata/RHSA-2026:13829
- https://access.redhat.com/errata/RHSA-2026:14020
- https://access.redhat.com/errata/RHSA-2026:14162
- https://access.redhat.com/errata/RHSA-2026:14200
- https://access.redhat.com/errata/RHSA-2026:14391
- https://access.redhat.com/errata/RHSA-2026:15980
- https://access.redhat.com/errata/RHSA-2026:16021
- https://access.redhat.com/errata/RHSA-2026:16024
- https://access.redhat.com/errata/RHSA-2026:16101
- https://access.redhat.com/errata/RHSA-2026:16476
- https://access.redhat.com/errata/RHSA-2026:16477
- https://access.redhat.com/errata/RHSA-2026:16505
- https://access.redhat.com/errata/RHSA-2026:16508
- https://access.redhat.com/errata/RHSA-2026:16532
- https://access.redhat.com/errata/RHSA-2026:16534
- https://access.redhat.com/errata/RHSA-2026:16535
- https://access.redhat.com/errata/RHSA-2026:16537
