Vulnerability · Published Jun 2, 2026 · Assigned by Go
CVE-2026-27145Inefficient candidate hostname parsing in crypto/x509
Medium 6.5
In plain English
A medium-severity security flaw in crypto/x509 from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 51.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | delve | 1.26.1-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:10 | go-fdo-client | 1.0.0-4.el10_2.5 | ALSA-2026:46394 |
| AlmaLinux:10 | go-fdo-server | 1.0.1-2.el10_2.3 | ALSA-2026:46395 |
| AlmaLinux:10 | go-fdo-server-manufacturer | 1.0.1-2.el10_2.3 | ALSA-2026:46395 |
| AlmaLinux:10 | go-fdo-server-owner | 1.0.1-2.el10_2.3 | ALSA-2026:46395 |
| AlmaLinux:10 | go-fdo-server-rendezvous | 1.0.1-2.el10_2.3 | ALSA-2026:46395 |
| AlmaLinux:10 | go-toolset | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 |
| AlmaLinux:8 | go-toolset | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | go-toolset | 1.26.4-1.el9_8 | ALSA-2026:29981 |
| AlmaLinux:10 | golang | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 |
| AlmaLinux:8 | golang | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang | 1.26.4-1.el9_8 | ALSA-2026:29981 |
| AlmaLinux:10 | golang-bin | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 |
| AlmaLinux:8 | golang-bin | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang-bin | 1.26.4-1.el9_8 | ALSA-2026:29981 |
| AlmaLinux:10 | golang-docs | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 |
| AlmaLinux:8 | golang-docs | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang-docs | 1.26.4-1.el9_8 | ALSA-2026:29981 |
| AlmaLinux:10 | golang-misc | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 |
| AlmaLinux:8 | golang-misc | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang-misc | 1.26.4-1.el9_8 | ALSA-2026:29981 |
| AlmaLinux:10 | golang-race | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 |
| AlmaLinux:8 | golang-race | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang-race | 1.26.4-1.el9_8 | ALSA-2026:29981 |
| AlmaLinux:10 | golang-src | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 |
| AlmaLinux:8 | golang-src | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang-src | 1.26.4-1.el9_8 | ALSA-2026:29981 |
| AlmaLinux:10 | golang-tests | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 |
| AlmaLinux:8 | golang-tests | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 |
| AlmaLinux:9 | golang-tests | 1.26.4-1.el9_8 | ALSA-2026:29981 |
| AlmaLinux:10 | ipp-usb | 0.9.27-7.el10_2.2 | ALSA-2026:35832 |
| AlmaLinux:10 | opentelemetry-collector | 0.152.1-1.el10_2 | ALSA-2026:34357 |
| AlmaLinux:9 | opentelemetry-collector | 0.152.1-1.el9_8 | ALSA-2026:34359 |
| AlmaLinux:9 | skopeo | 2:1.22.2-7.el9_8 | ALSA-2026:36317 |
| AlmaLinux:9 | skopeo-tests | 2:1.22.2-7.el9_8 | ALSA-2026:36317 |
| AlmaLinux:10 | yggdrasil | 0.4.9.2-1.el10_2 | ALSA-2026:39573 |
| AlmaLinux:10 | yggdrasil-devel | 0.4.9.2-1.el10_2 | ALSA-2026:39573 |
| Debian:12 | golang-1.19 | no fix listed | DEBIAN-CVE-2026-27145 |
| Debian:13 | golang-1.24 | no fix listed | DEBIAN-CVE-2026-27145 |
| Debian:14 | golang-1.26 | 1.26.4-1 | DEBIAN-CVE-2026-27145 |
| Go | stdlib | 1.25.11, 1.26.4 | GO-2026-5037 |
| Rocky Linux:8 | delve | 0:1.26.1-1.module+el8.10.0+40244+e7cb3ff8 | RLSA-2026:38995 |
| Rocky Linux:10 | go-fdo-client | 0:1.0.0-4.el10_2.5 | RLSA-2026:46394 |
| Rocky Linux:10 | go-fdo-server | 0:1.0.1-2.el10_2.3 | RLSA-2026:46395 |
| Rocky Linux:8 | golang | 0:1.26.5-1.module+el8.10.0+40244+e7cb3ff8 | RLSA-2026:38995 |
| Rocky Linux:10 | golang-github-openprinting-ipp-usb | 0:0.9.27-7.el10_2.2 | RLSA-2026:35832 |
| Rocky Linux:10 | opentelemetry-collector | 0:0.152.1-1.el10_2 | RLSA-2026:34357 |
| Rocky Linux:9 | opentelemetry-collector | 0:0.152.1-1.el9_8 | RLSA-2026:34359 |
| Rocky Linux:9 | skopeo | 2:1.22.2-7.el9_8 | RLSA-2026:36317 |
| Rocky Linux:10 | yggdrasil | 0:0.4.9.2-1.el10_2 | RLSA-2026:39573 |
| Ubuntu:22.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-27145 |
| Ubuntu:24.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-27145 |
| Ubuntu:25.10 | golang-1.24 | no fix listed | UBUNTU-CVE-2026-27145 |
| Ubuntu:26.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-27145 |
| Ubuntu:22.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-27145 |
| Ubuntu:24.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-27145 |
| Ubuntu:25.10 | golang-1.25 | no fix listed | UBUNTU-CVE-2026-27145 |
| Ubuntu:26.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-27145 |
| Ubuntu:22.04:LTS | golang-1.26 | no fix listed | UBUNTU-CVE-2026-27145 |
| Ubuntu:24.04:LTS | golang-1.26 | no fix listed | UBUNTU-CVE-2026-27145 |
| Ubuntu:26.04:LTS | golang-1.26 | no fix listed | UBUNTU-CVE-2026-27145 |
| Ubuntu:26.10 | golang-1.26 | no fix listed | UBUNTU-CVE-2026-27145 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | crypto/x509 | 0 – before 1.25.111.26.0-0 – before 1.26.4 |
Weakness: CWE-606 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- https://go.dev/cl/783621
- https://go.dev/issue/79694
- https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
- https://pkg.go.dev/vuln/GO-2026-5037
- https://access.redhat.com/security/cve/CVE-2026-27145 vdb-entry, x_refsource_REDHAT
- RHBZ#2484207 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:42079 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42080 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:68334 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:68335 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53416 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50319 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54757 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57482 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42082 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42150 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42151 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42240 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:49703 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:49702 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53413 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53374 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54168 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51187 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:46394 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:46395 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29980 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:35832 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34357 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39005 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42946 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39573 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:38995 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41930 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:61253 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60354 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57649 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53412 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60315 vendor-advisory, x_refsource_REDHAT