Inefficient Hostname Verification in Go's x509 Package Affecting Multiple Products

CVE-2026-27145

What is CVE-2026-27145?

A vulnerability in Go's x509 package leads to inefficient hostname verification due to multiple iterations over DNS Subject Alternative Name (SAN) entries. The method (*x509.Certificate).VerifyHostname invokes matchHostnames in a loop, causing significant performance degradation when dealing with a large list of SAN entries. This issue scales the verification time quadratically with the increasing number of SAN entries and the hostname's label count. Since hostname validation occurs before building the certificate chain, this inefficiency can affect the performance of applications even when handling untrusted certificates.

References