CVE-2026-32280 | BDVDB-2026-325665 Detail
Go standard librarycrypto/x509
Description#
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact high. Attack vector: network.
Weaknesses#
- CWE-770 Allocation of Resources Without Limits or Throttling
References#
- https://go.dev/cl/758320
- https://go.dev/issue/78282
- https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
- https://pkg.go.dev/vuln/GO-2026-4947
- https://access.redhat.com/security/cve/CVE-2026-32280
- https://bugzilla.redhat.com/show_bug.cgi?id=2456339
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json
- https://access.redhat.com/errata/RHSA-2026:24762
- https://access.redhat.com/errata/RHSA-2026:41019
- https://access.redhat.com/errata/RHSA-2026:16101
- https://access.redhat.com/errata/RHSA-2026:54191
- https://access.redhat.com/errata/RHSA-2026:24761
- https://access.redhat.com/errata/RHSA-2026:54757
- https://access.redhat.com/errata/RHSA-2026:59830
- https://access.redhat.com/errata/RHSA-2026:65838
Show all 40
- https://access.redhat.com/errata/RHSA-2026:28886
- https://access.redhat.com/errata/RHSA-2026:56785
- https://access.redhat.com/errata/RHSA-2026:28961
- https://access.redhat.com/errata/RHSA-2026:56910
- https://access.redhat.com/errata/RHSA-2026:56852
- https://access.redhat.com/errata/RHSA-2026:34097
- https://access.redhat.com/errata/RHSA-2026:60018
- https://access.redhat.com/errata/RHSA-2026:21655
- https://access.redhat.com/errata/RHSA-2026:57482
- https://access.redhat.com/errata/RHSA-2026:25180
- https://access.redhat.com/errata/RHSA-2026:27076
- https://access.redhat.com/errata/RHSA-2026:14391
- https://access.redhat.com/errata/RHSA-2026:36796
- https://access.redhat.com/errata/RHSA-2026:66401
- https://access.redhat.com/errata/RHSA-2026:28047
- https://access.redhat.com/errata/RHSA-2026:23244
- https://access.redhat.com/errata/RHSA-2026:39810
- https://access.redhat.com/errata/RHSA-2026:34365
- https://access.redhat.com/errata/RHSA-2026:20569
- https://access.redhat.com/errata/RHSA-2026:23103
- https://access.redhat.com/errata/RHSA-2026:19715
- https://access.redhat.com/errata/RHSA-2026:16024
- https://access.redhat.com/errata/RHSA-2026:19550
- https://access.redhat.com/errata/RHSA-2026:18032
- https://access.redhat.com/errata/RHSA-2026:18027
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.