p PatchFirst

CVE-2026-27145

CVE-2026-27145 · Inefficient candidate hostname parsing in crypto/x509

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

CVSS 6.5 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • crypto/x509

    Versions
    • ≥ 0, < 1.25.11: Affected (semver)
    • ≥ 1.26.0-0, < 1.26.4: Affected (semver)

    Update to 1.25.11; Update to 1.26.4

  • golang-1.19 Debian:12

    Versions
    • 1.19.10-1
    • 1.19.10-2
    • 1.19.11-1
    • 1.19.12-1
    • 1.19.12-2
    • 1.19.12-2~bpo11+1
    • 1.19.12-2~bpo12+1
    • 1.19.13-1
    • 1.19.13-1~bpo11+1
    • 1.19.13-1~bpo12+1
    • 1.19.8-2
    • 1.19.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Debian:13

    Versions
    • 1.24.12-1
    • 1.24.13-1
    • 1.24.13-2
    • 1.24.4-1
    • 1.24.4-2
    • 1.24.4-3
    • 1.24.4-4
    • 1.24.7-1
    • 1.24.8-1
    • 1.24.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.26 Debian:14

    Versions
    • 1.26.0-1
    • 1.26.1-1
    • 1.26.2-1
    • 1.26.2-2
    • 1.26.2-3
    • 1.26.3-1
    • 1.26.3-1~bpo13+1
    • 1.26.3-2
    • 1.26.3-2~bpo13+1
    • 1.26.4-1~bpo13+1
    • 1.26~rc2-1
    • 1.26~rc3-1
    • 1.26~rc3-2
    Affected ranges
    • ECOSYSTEM: < 1.26.4-1

    Update to 1.26.4-1

  • golang-1.24 Ubuntu:22.04:LTS

    Versions
    • 1.24.4-1ubuntu1~22.04.1
    • 1.24.4-1ubuntu1~22.04.2
    • 1.24.13-2~22.04.1
    • 1.24.13-2~22.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.25 Ubuntu:22.04:LTS

    Versions
    • 1.25.14-1~ubuntu0.22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.26 Ubuntu:22.04:LTS

    Versions
    • 1.26.8-1~ubuntu0.22.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Ubuntu:24.04:LTS

    Versions
    • 1.24.4-1ubuntu1~24.04.1
    • 1.24.4-1ubuntu1~24.04.2
    • 1.24.13-2~24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.25 Ubuntu:24.04:LTS

    Versions
    • 1.25.14-1~ubuntu0.24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.26 Ubuntu:24.04:LTS

    Versions
    • 1.26.8-1~ubuntu0.24.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Ubuntu:25.10

    Versions
    • 1.24.2-1
    • 1.24.2-2
    • 1.24.4-1
    • 1.24.4-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.25 Ubuntu:25.10

    Versions
    • 1.25.0-0ubuntu1
    • 1.25.7-2~25.10.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.26 Ubuntu:26.10

    Versions
    • 1.26.0-1
    • 1.26.2-3
    • 1.26.4-1
    • 1.26.5-1
    • 1.26.6-2
    • 1.26.7-1
    • 1.26.8-1
    • 1.26.8-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Ubuntu:26.04:LTS

    Versions
    • 1.24.4-1ubuntu1
    • 1.24.9-1
    • 1.24.13-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.25 Ubuntu:26.04:LTS

    Versions
    • 1.25.0-0ubuntu1
    • 1.25.7-2
    • 1.25.14-1~ubuntu0.26.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.26 Ubuntu:26.04:LTS

    Versions
    • 1.26~rc3-2
    • 1.26.0-1
    • 1.26.8-1~ubuntu0.26.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →