CVE-2026-32280
CVE-2026-32280 · Unexpected work during chain building in crypto/x509
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
CVSS 7.5 · High · EPSS 0.6% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
crypto/x509
- Versions
- ≥ 0, < 1.25.9: Affected (semver)
- ≥ 1.26.0-0, < 1.26.2: Affected (semver)
Update to 1.25.9; Update to 1.26.2
golang-1.19 Debian:12
- Versions
- 1.19.10-1
- 1.19.10-2
- 1.19.11-1
- 1.19.12-1
- 1.19.12-2
- 1.19.12-2~bpo11+1
- 1.19.12-2~bpo12+1
- 1.19.13-1
- 1.19.13-1~bpo11+1
- 1.19.13-1~bpo12+1
- 1.19.8-2
- 1.19.9-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Debian:13
- Versions
- 1.24.12-1
- 1.24.13-1
- 1.24.13-2
- 1.24.4-1
- 1.24.4-2
- 1.24.4-3
- 1.24.4-4
- 1.24.7-1
- 1.24.8-1
- 1.24.9-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.26 Debian:14
- Versions
- 1.26.0-1
- 1.26.1-1
- 1.26~rc2-1
- 1.26~rc3-1
- 1.26~rc3-2
- Affected ranges
- ECOSYSTEM: < 1.26.2-1
Update to 1.26.2-1
golang-1.10 Ubuntu:14.04:LTS
- Versions
- 1.10.4-2ubuntu1~14.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:Pro:16.04:LTS
- Versions
- 1.13.8-1ubuntu1~16.04.2
- 1.13.8-1ubuntu1~16.04.3
- 1.13.8-1ubuntu1~16.04.3+esm2
- 1.13.8-1ubuntu1~16.04.3+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:Pro:16.04:LTS
- Versions
- 1.18.1-1ubuntu1~16.04.6
- 1.18.1-1ubuntu1~16.04.6+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:Pro:18.04:LTS
- Versions
- 1.13.8-1ubuntu1~18.04.2
- 1.13.8-1ubuntu1~18.04.3
- 1.13.8-1ubuntu1~18.04.4
- 1.13.8-1ubuntu1~18.04.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.16 Ubuntu:Pro:18.04:LTS
- Versions
- 1.16.2-0ubuntu1~18.04.2
- 1.16.2-0ubuntu1~18.04.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:Pro:18.04:LTS
- Versions
- 1.18.1-1ubuntu1~18.04.3
- 1.18.1-1ubuntu1~18.04.4
- 1.18.1-1ubuntu1~18.04.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:20.04:LTS
- Versions
- 1.13.1-1ubuntu1
- 1.13.3-1ubuntu1
- 1.13.4-1ubuntu1
- 1.13.5-1ubuntu1
- 1.13.6-1ubuntu1
- 1.13.6-2ubuntu1
- 1.13.7-1ubuntu1
- 1.13.8-1ubuntu1
- 1.13.8-1ubuntu1.1
- 1.13.8-1ubuntu1.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.14 Ubuntu:20.04:LTS
- Versions
- 1.14~beta1-1
- 1.14~beta1-2
- 1.14~rc1-1
- 1.14-1
- 1.14.1-1
- 1.14.2-1
- 1.14.2-1ubuntu1
- 1.14.3-2ubuntu2~20.04.1
- 1.14.3-2ubuntu2~20.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.16 Ubuntu:Pro:20.04:LTS
- Versions
- 1.16.2-0ubuntu1~20.04
- 1.16.2-0ubuntu1~20.04.1
- 1.16.2-0ubuntu1~20.04.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:20.04:LTS
- Versions
- 1.18.1-1ubuntu1~20.04.1
- 1.18.1-1ubuntu1~20.04.2
- 1.18.1-1ubuntu1~20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.20 Ubuntu:20.04:LTS
- Versions
- 1.20.3-1ubuntu0.1~20.04
- 1.20.3-1ubuntu0.1~20.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.21 Ubuntu:20.04:LTS
- Versions
- 1.21.1-1~ubuntu20.04.1
- 1.21.1-1~ubuntu20.04.2
- 1.21.1-1~ubuntu20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.22 Ubuntu:20.04:LTS
- Versions
- 1.22.2-2~20.04.1
- 1.22.2-2~20.04.2
- 1.22.2-2~20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.17 Ubuntu:22.04:LTS
- Versions
- 1.17-1ubuntu2
- 1.17.3-1ubuntu1
- 1.17.3-1ubuntu2
- 1.17.13-3ubuntu1
- 1.17.13-3ubuntu1.2
- 1.17.13-3ubuntu1.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:22.04:LTS
- Versions
- 1.18~beta1-0ubuntu1
- 1.18~beta2-1ubuntu1
- 1.18~beta2-1ubuntu2
- 1.18~rc1-1ubuntu1
- 1.18-1ubuntu1
- 1.18.1-1ubuntu1
- 1.18.1-1ubuntu1.1
- 1.18.1-1ubuntu1.2
- 1.18.1-1ubuntu1.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.20 Ubuntu:22.04:LTS
- Versions
- 1.20.3-1ubuntu0.1~22.04
- 1.20.3-1ubuntu0.1~22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.21 Ubuntu:22.04:LTS
- Versions
- 1.21.1-1~ubuntu22.04.1
- 1.21.1-1~ubuntu22.04.2
- 1.21.1-1~ubuntu22.04.3
- 1.21.1-1~ubuntu22.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.22 Ubuntu:22.04:LTS
- Versions
- 1.22.2-2~22.04
- 1.22.2-2~22.04.1
- 1.22.2-2~22.04.2
- 1.22.2-2~22.04.3
- 1.22.2-2~22.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.23 Ubuntu:22.04:LTS
- Versions
- 1.23.1-1~22.04
- 1.23.1-1~22.04.2
- 1.23.1-1~22.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Ubuntu:22.04:LTS
- Versions
- 1.24.4-1ubuntu1~22.04.1
- 1.24.4-1ubuntu1~22.04.2
- 1.24.13-2~22.04.1
- 1.24.13-2~22.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://go.dev/cl/758320
- https://go.dev/issue/78282
- https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
- https://pkg.go.dev/vuln/GO-2026-4947
- https://access.redhat.com/security/cve/CVE-2026-32280
- https://bugzilla.redhat.com/show_bug.cgi?id=2456339
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json
- https://access.redhat.com/errata/RHSA-2026:24762
- https://access.redhat.com/errata/RHSA-2026:41019
- https://access.redhat.com/errata/RHSA-2026:16101
- https://access.redhat.com/errata/RHSA-2026:54191
- https://access.redhat.com/errata/RHSA-2026:24761
- https://access.redhat.com/errata/RHSA-2026:54757
- https://access.redhat.com/errata/RHSA-2026:59830
- https://access.redhat.com/errata/RHSA-2026:65838
- https://access.redhat.com/errata/RHSA-2026:28886
- https://access.redhat.com/errata/RHSA-2026:56785
- https://access.redhat.com/errata/RHSA-2026:28961
- https://access.redhat.com/errata/RHSA-2026:56910
- https://access.redhat.com/errata/RHSA-2026:56852
- https://access.redhat.com/errata/RHSA-2026:34097
- https://access.redhat.com/errata/RHSA-2026:60018
- https://access.redhat.com/errata/RHSA-2026:21655
- https://nvd.nist.gov/vuln/detail/CVE-2026-32280