GO-2026-4946

vendorUSosv

Inefficient policy validation in crypto/x509

view advisory published 2026-04-07Licence: per source

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-32281US	high7.5	0.36% (29th)	—	2026-04-08
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/758061FIX
https://go.dev/issue/78281REPORT
https://groups.google.com/g/golang-announce/c/0uYbvbPZRWUWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan