VDB
RHSA-2026:49767
RHSA-2026:49767
PUBLISHED
CVSS 7.099999904632568 HIGH
A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | fetch-tsa-certs-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4 | *, *, * |
| Red Hat | trillian-cli-stack-v1-4-1.4.3@ppc64le as a component of Red Hat Trusted Artifact Signer 1.4 | 1.4.3 |
| Red Hat | fetch-tsa-certs-cli-stack-v1-4-1.4.3@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4 | 1.4.3 |
| Red Hat | rekor-cli-stack-v1-4-1.4.3@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4 | 1.4.3 |
| Red Hat | cosign-cli-stack-v1-4@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4 | *, *, * |
| Red Hat | conforma-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4 | *, *, * |
| Red Hat | rekor-cli-stack-v1-4-1.4.3@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4 | 1.4.3 |
| Red Hat | tuftool-cli-stack-v1-4@amd64 as a component of Red Hat Trusted Artifact Signer 1.4 | *, *, * |
| Red Hat | rekor-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4 | *, *, * |
| Red Hat | conforma-cli-stack-v1-4-1.4.3@s390x as a component of Red Hat Trusted Artifact Signer 1.4 | 1.4.3 |
| Red Hat | trillian-cli-stack-v1-4-1.4.3@arm64_darwin as a component of Red Hat Trusted Artifact Signer 1.4 | 1.4.3 |
| Red Hat | conforma-cli-stack-v1-4@arm64 as a component of Red Hat Trusted Artifact Signer 1.4 | *, *, * |
| Red Hat | gitsign-cli-stack-v1-4-1.4.3@amd64 as a component of Red Hat Trusted Artifact Signer 1.4 | 1.4.3 |
| Red Hat | fetch-tsa-certs-cli-stack-v1-4@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4 | *, *, * |
| Red Hat | trillian-cli-stack-v1-4-1.4.3@amd64_darwin as a component of Red Hat Trusted Artifact Signer 1.4 | 1.4.3 |
| Red Hat | rekor-cli-stack-v1-4-1.4.3@amd64 as a component of Red Hat Trusted Artifact Signer 1.4 | 1.4.3 |
| Red Hat | model-transparency-cli-stack-v1-4-1.4.3@amd64_windows as a component of Red Hat Trusted Artifact Signer 1.4 | 1.4.3 |
| Red Hat | model-transparency-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4 | *, *, * |
| Red Hat | rekor-cli-stack-v1-4@s390x as a component of Red Hat Trusted Artifact Signer 1.4 | *, *, * |
| Red Hat | conforma-cli-stack-v1-4-1.4.3@arm64 as a component of Red Hat Trusted Artifact Signer 1.4 | 1.4.3 |
…and 84 more
Timeline
- Aug 3, 2026 CVE Published
- Sep 22, 2026 CVE Updated
- Sep 22, 2026 Distribution Patch
- Sep 22, 2026 Distribution Patch
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
- Sep 22, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:49767 advisory
- https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4 advisory
- https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index advisory
- https://access.redhat.com/security/cve/CVE-2026-27145 advisory
- https://access.redhat.com/security/cve/CVE-2026-33811 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
- https://access.redhat.com/security/cve/CVE-2026-39821 advisory
- https://access.redhat.com/security/cve/CVE-2026-39828 advisory
- https://access.redhat.com/security/cve/CVE-2026-39829 advisory
- https://access.redhat.com/security/cve/CVE-2026-39830 advisory
- https://access.redhat.com/security/cve/CVE-2026-39832 advisory
- https://access.redhat.com/security/cve/CVE-2026-39833 advisory
- https://access.redhat.com/security/cve/CVE-2026-39835 advisory
- https://access.redhat.com/security/cve/CVE-2026-42151 advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 advisory
- https://access.redhat.com/security/cve/CVE-2026-42508 advisory
- https://access.redhat.com/security/cve/CVE-2026-46595 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49767.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2484207 issue
…and 92 more