Inefficient Hostname Verification in Go's x509 Package Affecting Multiple Products
CVE-2026-27145

6.5MEDIUM

Key Information:

Vendor

Go Standard Library

Status
Crypto/x509
Vendor
CVE Published:
2 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-27145?

A vulnerability in Go's x509 package leads to inefficient hostname verification due to multiple iterations over DNS Subject Alternative Name (SAN) entries. The method (*x509.Certificate).VerifyHostname invokes matchHostnames in a loop, causing significant performance degradation when dealing with a large list of SAN entries. This issue scales the verification time quadratically with the increasing number of SAN entries and the hostname's label count. Since hostname validation occurs before building the certificate chain, this inefficiency can affect the performance of applications even when handling untrusted certificates.

Affected Version(s)

crypto/x509 0 < 1.25.11

crypto/x509 1.26.0-0 < 1.26.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-27145
Created by HORKimhab

References

https://go.dev/cl/783621
https://go.dev/issue/79694
https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakub Ciolek - https://ciolek.dev/
.