GO-2025-4175

vendorUSosv

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

view advisory published 2025-12-02Licence: per source

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-61727US	—	0.28% (21st)	—	2025-12-03
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain t…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/723900FIX
https://go.dev/issue/76442REPORT
https://groups.google.com/g/golang-announce/c/8FJoBkPddm4WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan