Description
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
Metrics
CVSS 3.1 6.5/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:HWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | crypto/x509 | < 1.25.11; >= 1.26.0-0, < 1.26.4 |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 10 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 for RHEL 10 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 for RHEL 9 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | — |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | — |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | — |
| Red Hat | RHEM 1.1 for RHEL 10 | — |
| Red Hat | RHEM 1.1 for RHEL 9 | — |
| Red Hat | RHEM 1.2 for RHEL 10 | — |
| Red Hat | RHEM 1.2 for RHEL 9 | — |
| Red Hat | Streams for Apache Kafka 3.2.1 | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.19 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
References
- https://go.dev/cl/783621
- https://go.dev/issue/79694
- https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
- https://pkg.go.dev/vuln/GO-2026-5037
- https://access.redhat.com/errata/RHSA-2026:23262
- https://access.redhat.com/errata/RHSA-2026:23264
- https://access.redhat.com/errata/RHSA-2026:29980
- https://access.redhat.com/errata/RHSA-2026:29981
- https://access.redhat.com/errata/RHSA-2026:33574
- https://access.redhat.com/errata/RHSA-2026:34357
- https://access.redhat.com/errata/RHSA-2026:34359
- https://access.redhat.com/errata/RHSA-2026:35832
- https://access.redhat.com/errata/RHSA-2026:36317
- https://access.redhat.com/errata/RHSA-2026:36648
- https://access.redhat.com/errata/RHSA-2026:36797
- https://access.redhat.com/errata/RHSA-2026:38995
- https://access.redhat.com/errata/RHSA-2026:39005
- https://access.redhat.com/errata/RHSA-2026:39573
- https://access.redhat.com/errata/RHSA-2026:39879
- https://access.redhat.com/errata/RHSA-2026:41030
- https://access.redhat.com/errata/RHSA-2026:41036
- https://access.redhat.com/errata/RHSA-2026:41930
- https://access.redhat.com/errata/RHSA-2026:42043
- https://access.redhat.com/errata/RHSA-2026:42047
- https://access.redhat.com/errata/RHSA-2026:42049
- https://access.redhat.com/errata/RHSA-2026:42050
- https://access.redhat.com/errata/RHSA-2026:42051
- https://access.redhat.com/errata/RHSA-2026:42079
- https://access.redhat.com/errata/RHSA-2026:42080
- https://access.redhat.com/errata/RHSA-2026:42082
- https://access.redhat.com/errata/RHSA-2026:42142
- https://access.redhat.com/errata/RHSA-2026:42150
- https://access.redhat.com/errata/RHSA-2026:42151
- https://access.redhat.com/errata/RHSA-2026:42240
- https://access.redhat.com/errata/RHSA-2026:42644
- https://access.redhat.com/errata/RHSA-2026:42946
- https://access.redhat.com/errata/RHSA-2026:44622
- https://access.redhat.com/errata/RHSA-2026:46394
- https://access.redhat.com/errata/RHSA-2026:46395
- https://access.redhat.com/errata/RHSA-2026:47149
- https://access.redhat.com/errata/RHSA-2026:47735
- https://access.redhat.com/errata/RHSA-2026:47737
- https://access.redhat.com/errata/RHSA-2026:49702
- https://access.redhat.com/errata/RHSA-2026:49703
- https://access.redhat.com/errata/RHSA-2026:49705
- https://access.redhat.com/errata/RHSA-2026:49712
- https://access.redhat.com/errata/RHSA-2026:49729
- https://access.redhat.com/errata/RHSA-2026:49744
- https://access.redhat.com/errata/RHSA-2026:49765
- https://access.redhat.com/errata/RHSA-2026:49770
- https://access.redhat.com/errata/RHSA-2026:50205
- https://access.redhat.com/errata/RHSA-2026:50319
- https://access.redhat.com/errata/RHSA-2026:51057
- https://access.redhat.com/errata/RHSA-2026:51187
- https://access.redhat.com/errata/RHSA-2026:52946
- https://access.redhat.com/errata/RHSA-2026:53374
- https://access.redhat.com/errata/RHSA-2026:53412
- https://access.redhat.com/errata/RHSA-2026:53413
- https://access.redhat.com/errata/RHSA-2026:53415
- https://access.redhat.com/errata/RHSA-2026:53416
Timeline
- Published
- Jun 2, 2026
- Last modified
- Sep 18, 2026
- NVD status
- Awaiting Analysis