7.5Hoch

CVE-2026-32280Unexpected work during chain building in crypto/x509

Go standard library crypto/x509; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Veröffentlicht: 2026-04-08 04:06 (vor 7 Monaten)

Beschreibung

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

Schwachstellentyp (CWE): CWE-770

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
acm	2.14	—
advanced cluster security	4.10	—
advanced cluster security	4.9	—
ansible automation platform	2.5	—
ansible automation platform	2.6	—
apache camel hawtio	4.4	—
container native virtualization	4.16	—
cryostat	4	—
edge manager	1.0	—
edge manager	1.1	—
Go standard library	crypto/x509	< 1.25.9, 1.26.0-0 – < 1.26.2
golang	go	< 1.25.9
lightspeed for runtimes	1.0	—
logging	6.0	—
logging	6.2	—
logging	6.4	—
mirror registry	2.0	—
multicluster engine	2.10	—
multicluster engine	2.11	—
multicluster engine	2.17	—
multicluster engine	2.6	—
multicluster engine	2.8	—
multicluster globalhub	1.4	—
multicluster globalhub	1.5	—
multicluster globalhub	1.6	—
network observ optr	1.11	—
openshift	4.12	—
openshift	4.13	—
openshift	4.14	—
openshift	4.15	—
openshift	4.16	—
openshift	4.17	—
openshift	4.18	—
openshift	4.19	—
openshift	4.21	—
openshift ai	2.25	—
openshift ai	3.4	—
openshift api data protection	1.3	—
openshift api data protection	1.4	—
openshift api data protection	1.5	—
openshift builds	1.7	—
openshift compliance operator	1	—
openshift custom metrics autoscaler	2.19	—
openshift devspaces	3.28	—
openshift distributed tracing	3.9	—
openstack	16.2	—
openstack	17.1	—
openstack	18.0	—
Red Hat	Cryostat 4 on RHEL 9	all versions
Red Hat	HawtIO HawtIO 4.4.0	all versions
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	all versions
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	all versions
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 10	all versions
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	all versions
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	all versions
rhdh	1.8	—
rhdh	1.9	—
rhmt	1.8	—
satellite	6.16	—
satellite	6.19	—
service mesh	2.6	—
service mesh	3.0	—
service mesh	3.1	—
service mesh	3.2	—
service mesh	3.3	—

Referenzen und Patches

CPE-Treffer (NVD) (2)

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* < 1.25.9
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* ≥ 1.26.0 < 1.26.2

CVSS-Score

7.5Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Keine
Integrität: Keine
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	7.5Hoch
redhat-SADP	CVSS 3.1	7.5Hoch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.5Hoch
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	CVSS 3.1	7.5Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.63%

höher als 50 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: yes
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2026-03-11
Veröffentlicht2026-04-08 04:06
Bei IP-DB eingegangen2026-10-24 23:42
Zuletzt aktualisiert2026-09-18 16:17

Vergeben von (CNA): Go
NVD-Status: Modified

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Go

6.8Mittel

CVE-2026-111943 vor 18 Tagen

Distrust compromised intermediate certificates in crypto/x509

Go standard library crypto/x509

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

7.5Hoch

CVE-2026-97032 vor 1 Monat

HTTP/2 server crash due to HPACK encoder race in net/http

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/http2

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part …

7.5Hoch

CVE-2026-78660 vor 1 Monat

HTTP/2 transport accepts malformed framing-related headers in net/http

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/http2

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such header…

9.1Kritisch

CVE-2026-78663 vor 1 Monat

Double flow control refund on HTTP/2 server streams in net/http

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/http2

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client…

7.5Hoch

CVE-2026-78667 vor 1 Monat

Lack of limit on size of parsed Range headers in net/http

Go standard library net/http

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

7.5Hoch

CVE-2026-78669 vor 1 Monat

Excessive CPU consumption from repeated initial window changes in net/http

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/http2

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.