CVE-2026-32281
CVE-2026-32281 · Inefficient policy validation in crypto/x509
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
CVSS 7.5 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
crypto/x509
- Versions
- ≥ 0, < 1.25.9: Affected (semver)
- ≥ 1.26.0-0, < 1.26.2: Affected (semver)
Update to 1.25.9; Update to 1.26.2
golang-1.19 Debian:12
- Versions
- 1.19.10-1
- 1.19.10-2
- 1.19.11-1
- 1.19.12-1
- 1.19.12-2
- 1.19.12-2~bpo11+1
- 1.19.12-2~bpo12+1
- 1.19.13-1
- 1.19.13-1~bpo11+1
- 1.19.13-1~bpo12+1
- 1.19.8-2
- 1.19.9-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Debian:13
- Versions
- 1.24.12-1
- 1.24.13-1
- 1.24.13-2
- 1.24.4-1
- 1.24.4-2
- 1.24.4-3
- 1.24.4-4
- 1.24.7-1
- 1.24.8-1
- 1.24.9-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.26 Debian:14
- Versions
- 1.26.0-1
- 1.26.1-1
- 1.26~rc2-1
- 1.26~rc3-1
- 1.26~rc3-2
- Affected ranges
- ECOSYSTEM: < 1.26.2-1
Update to 1.26.2-1
golang-1.10 Ubuntu:14.04:LTS
- Versions
- 1.10.4-2ubuntu1~14.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.10 Ubuntu:16.04:LTS
- Versions
- 1.10.4-2ubuntu1~16.04.1
- 1.10.4-2ubuntu1~16.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.6 Ubuntu:16.04:LTS
- Versions
- 1.6-0ubuntu1
- 1.6-0ubuntu2
- 1.6-0ubuntu3
- 1.6-0ubuntu4
- 1.6-0ubuntu5
- 1.6.1-0ubuntu1
- 1.6.2-0ubuntu5~16.04
- 1.6.2-0ubuntu5~16.04.2
- 1.6.2-0ubuntu5~16.04.3
- 1.6.2-0ubuntu5~16.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:Pro:16.04:LTS
- Versions
- 1.13.8-1ubuntu1~16.04.2
- 1.13.8-1ubuntu1~16.04.3
- 1.13.8-1ubuntu1~16.04.3+esm2
- 1.13.8-1ubuntu1~16.04.3+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:Pro:16.04:LTS
- Versions
- 1.18.1-1ubuntu1~16.04.6
- 1.18.1-1ubuntu1~16.04.6+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.10 Ubuntu:18.04:LTS
- Versions
- 1.10~rc1-1
- 1.10~rc1-1ubuntu1
- 1.10~rc1-2ubuntu1
- 1.10~rc2-1ubuntu1
- 1.10-1ubuntu1
- 1.10.1-1ubuntu2
- 1.10.4-2ubuntu1~18.04.1
- 1.10.4-2ubuntu1~18.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:Pro:18.04:LTS
- Versions
- 1.13.8-1ubuntu1~18.04.2
- 1.13.8-1ubuntu1~18.04.3
- 1.13.8-1ubuntu1~18.04.4
- 1.13.8-1ubuntu1~18.04.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.16 Ubuntu:Pro:18.04:LTS
- Versions
- 1.16.2-0ubuntu1~18.04.2
- 1.16.2-0ubuntu1~18.04.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:Pro:18.04:LTS
- Versions
- 1.18.1-1ubuntu1~18.04.3
- 1.18.1-1ubuntu1~18.04.4
- 1.18.1-1ubuntu1~18.04.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.8 Ubuntu:18.04:LTS
- Versions
- 1.8.3-2ubuntu1
- 1.8.3-2ubuntu1.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.9 Ubuntu:18.04:LTS
- Versions
- 1.9.1-2ubuntu1
- 1.9.2-1ubuntu1
- 1.9.2-3ubuntu1
- 1.9.3-1ubuntu1
- 1.9.4-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:20.04:LTS
- Versions
- 1.13.1-1ubuntu1
- 1.13.3-1ubuntu1
- 1.13.4-1ubuntu1
- 1.13.5-1ubuntu1
- 1.13.6-1ubuntu1
- 1.13.6-2ubuntu1
- 1.13.7-1ubuntu1
- 1.13.8-1ubuntu1
- 1.13.8-1ubuntu1.1
- 1.13.8-1ubuntu1.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.14 Ubuntu:20.04:LTS
- Versions
- 1.14~beta1-1
- 1.14~beta1-2
- 1.14~rc1-1
- 1.14-1
- 1.14.1-1
- 1.14.2-1
- 1.14.2-1ubuntu1
- 1.14.3-2ubuntu2~20.04.1
- 1.14.3-2ubuntu2~20.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.16 Ubuntu:Pro:20.04:LTS
- Versions
- 1.16.2-0ubuntu1~20.04
- 1.16.2-0ubuntu1~20.04.1
- 1.16.2-0ubuntu1~20.04.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:20.04:LTS
- Versions
- 1.18.1-1ubuntu1~20.04.1
- 1.18.1-1ubuntu1~20.04.2
- 1.18.1-1ubuntu1~20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.20 Ubuntu:20.04:LTS
- Versions
- 1.20.3-1ubuntu0.1~20.04
- 1.20.3-1ubuntu0.1~20.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.21 Ubuntu:20.04:LTS
- Versions
- 1.21.1-1~ubuntu20.04.1
- 1.21.1-1~ubuntu20.04.2
- 1.21.1-1~ubuntu20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.22 Ubuntu:20.04:LTS
- Versions
- 1.22.2-2~20.04.1
- 1.22.2-2~20.04.2
- 1.22.2-2~20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.17 Ubuntu:22.04:LTS
- Versions
- 1.17-1ubuntu2
- 1.17.3-1ubuntu1
- 1.17.3-1ubuntu2
- 1.17.13-3ubuntu1
- 1.17.13-3ubuntu1.2
- 1.17.13-3ubuntu1.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:22.04:LTS
- Versions
- 1.18~beta1-0ubuntu1
- 1.18~beta2-1ubuntu1
- 1.18~beta2-1ubuntu2
- 1.18~rc1-1ubuntu1
- 1.18-1ubuntu1
- 1.18.1-1ubuntu1
- 1.18.1-1ubuntu1.1
- 1.18.1-1ubuntu1.2
- 1.18.1-1ubuntu1.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published