6.5Medium

CVE-2026-27145Inefficient candidate hostname parsing in crypto/x509

Go standard library crypto/x509; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Ha… Published: 2026-06-03 01:01 (5 months ago)

Description

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

Weakness (CWE): CWE-407 CWE-606

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
acm	2.11	—
acm	2.13	—
acm	2.14	—
acm	2.15	—
acm	2.16	—
acm	2.17	—
amq streams	3.2	—
ansible automation platform	2.5	—
ansible automation platform	2.6	—
ansible automation platform	2.7	—
cert manager	1.19	—
cluster observability operator	1.5	—
edge manager	1.1	—
edge manager	1.2	—
external secrets operator	1.1	—
Go standard library	crypto/x509	< 1.25.11, 1.26.0-0 – < 1.26.4
lightspeed for runtimes	1.0	—
multicluster engine	2.10	—
multicluster engine	2.11	—
multicluster engine	2.17	—
multicluster engine	2.6	—
multicluster engine	2.8	—
multicluster engine	2.9	—
multicluster globalhub	1.4	—
multicluster globalhub	1.6	—
multicluster globalhub	1.7	—
multicluster globalhub	1.8	—
openshift	4.17	—
openshift	4.18	—
openshift	4.21	—
openshift ai	2.25	—
openshift api data protection	1.5	—
openshift builds	1.7	—
openshift builds	1.8	—
openshift compliance operator	1	—
openshift distributed tracing	3.10	—
openstack	16.2	—
Red Hat	Cert Manager support for Red Hat OpenShift release 1.19	all versions
Red Hat	Cluster Observability Operator 1.5.0	all versions
Red Hat	Compliance Operator 1	all versions
Red Hat	external secrets operator for Red Hat OpenShift 1.1	all versions
Red Hat	multicluster engine for Kubernetes 2.1	all versions
Red Hat	multicluster engine for Kubernetes 2.11	all versions
Red Hat	multicluster engine for Kubernetes 2.17	all versions
Red Hat	multicluster engine for Kubernetes 2.6	all versions
Red Hat	multicluster engine for Kubernetes 2.8	all versions
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	all versions
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	all versions
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 10	all versions
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	all versions
Red Hat	Red Hat Ansible Automation Platform 2.7 for RHEL 10	all versions
Red Hat	Red Hat Ansible Automation Platform 2.7 for RHEL 9	all versions
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	all versions
Red Hat	Red Hat OpenShift Container Platform 4.18	all versions
Red Hat	Red Hat OpenStack Platform 16.2	all versions
Red Hat	Red Hat Satellite 6.16 for RHEL 8	all versions
Red Hat	Red Hat Satellite 6.16 for RHEL 9	all versions
Red Hat	Red Hat Satellite 6.17 for RHEL 9	all versions
Red Hat	Red Hat Satellite 6.18 for RHEL 9	all versions
Red Hat	Red Hat Satellite 6.19 for RHEL 9	all versions
Red Hat	RHEM 1.1 for RHEL 10	all versions
Red Hat	RHEM 1.1 for RHEL 9	all versions
Red Hat	RHEM 1.2 for RHEL 10	all versions
Red Hat	RHEM 1.2 for RHEL 9	all versions
Red Hat	Streams for Apache Kafka 3.2.1	all versions
rhdh	1.9	—
satellite	6.16	—
satellite	6.17	—
satellite	6.18	—
satellite	6.19	—
service mesh	3.0	—
service mesh	3.1	—
service mesh	3.2	—
service mesh	3.3	—
service mesh	3.4	—
source to image	1.6	—
trusted artifact signer	1.4	—
webterminal	1.11	—
webterminal	1.12	—
webterminal	1.13	—
webterminal	1.14	—
webterminal	1.15	—
webterminal	1.16	—

References and patches

CVSS score

6.5Medium

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

All scores (4)

CISA-ADP	CVSS 3.1	6.5Medium
redhat-SADP	CVSS 3.1	7.5High
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	6.5Medium
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	CVSS 3.1	7.5High

EPSS (chance of exploitation in 30 days)

0.59%

higher than 49% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2026-02-17
Published2026-06-03 01:01
Reached IP-DB2026-10-24 23:45
Last updated2026-09-18 16:17

Assigned by (CNA): Go
NVD status: Awaiting Analysis

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Go

Unscored

CVE-2026-97033 4 days ago

Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and …

Unscored

CVE-2026-97034 4 days ago

Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go

Go toolchain cmd/go

When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in l…

Unscored

CVE-2026-97054 4 days ago

HTTP/1 server crash due to MaxBytesReader header race in net/http

Go standard library net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …

Unscored

CVE-2026-97035 4 days ago

Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go

Go toolchain cmd/go

When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-*" or "-gnat*" flags in "#cgo" directives. The "-g*" wildcard in the compiler and linker …

Unscored

CVE-2026-97036 4 days ago

Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

Go toolchain cmd/go

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_librar…

Unscored

CVE-2026-97037 4 days ago

Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols"…