Logo
›
›vulnerability›CVE-2026-27145
Name
CVE-2026-27145
Source
NVD ( link)Debian ( link)
Description
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
CWEs
CWE-606
Published Date
Updated Date
Workaround
-
Advisories

Analysis#

Affected Component
Analysis
golang-bootstrap
Exploitable

Vulnerability Ratings#

6.5
CVSSv31
7.5
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
golang-bootstrap
openwrt
master
1.24.13-r1
Exploitable
golang1.27
openwrt
master
1.27.0-r1
Not Affected
go
yocto
kirkstone
1.17.13
Exploitable
go-binary-native
yocto
kirkstone
1.17.13
Exploitable
go
yocto
master
1.26.6
Not Affected
go-binary-native
yocto
master
1.26.6
Not Affected
go
yocto
scarthgap
1.22.12
Patched
go-binary-native
yocto
scarthgap
1.22.12
Exploitable

Resolved with patches#

go (yocto:scarthgap)

#
Title
Author
Resolve
1
crypto/x509: split candidate hostname only once
Ian Alexander <jitsu@google.com>
CVE-2026-27145