VDB
GHSA-m4pr-4j3g-9v7v
GHSA-m4pr-4j3g-9v7v
PUBLISHED
CVSS 7.5 HIGH
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Timeline
- Apr 8, 2026 CVE Published
- May 1, 2026 Security Advisory
- Aug 6, 2026 Distribution Patch
- Aug 6, 2026 Distribution Patch
- Aug 6, 2026 Distribution Patch
- Aug 6, 2026 Distribution Patch
- Aug 6, 2026 Distribution Patch
- Aug 6, 2026 Distribution Patch
- Aug 6, 2026 Distribution Patch
- Aug 6, 2026 Distribution Patch
- Aug 6, 2026 Distribution Patch
- Aug 6, 2026 Distribution Patch
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-32280 advisory
- https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU url
- https://access.redhat.com/errata/RHSA-2026:22962 url
- https://access.redhat.com/errata/RHSA-2026:26585 url
- https://access.redhat.com/errata/RHSA-2026:26636 url
- https://access.redhat.com/errata/RHSA-2026:28441 url
- https://access.redhat.com/errata/RHSA-2026:29455 url
- https://access.redhat.com/errata/RHSA-2026:29703 url
- https://access.redhat.com/errata/RHSA-2026:29854 url
- https://access.redhat.com/errata/RHSA-2026:34097 url
- https://access.redhat.com/errata/RHSA-2026:34192 url
- https://access.redhat.com/errata/RHSA-2026:23102 url
- https://access.redhat.com/errata/RHSA-2026:23345 url
- https://access.redhat.com/errata/RHSA-2026:24337 url
- https://access.redhat.com/errata/RHSA-2026:24359 url
- https://access.redhat.com/errata/RHSA-2026:24470 url
- https://access.redhat.com/errata/RHSA-2026:24761 url
- https://access.redhat.com/errata/RHSA-2026:24853 url
- https://access.redhat.com/errata/RHSA-2026:24977 url
- https://access.redhat.com/errata/RHSA-2026:25089 url
…and 145 more