BIT-golang-2026-27145

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/golang/BIT-golang-2026-27145.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-golang-2026-27145
Aliases
Published
2026-06-05T05:44:57Z
Modified
2026-09-18T10:00:02Z
Summary
Inefficient candidate hostname parsing in crypto/x509
Details

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"
    ],
    "severity":  "High"
}
References

Affected packages

Bitnami / golang

Package

Name
golang
Purl
pkg:bitnami/golang

Severity

  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.25.11
Introduced
1.26.0-0
Fixed
1.26.4

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/golang/BIT-golang-2026-27145.json"