Denial of Service Vulnerability in Go's Certificate Chain Validation

CVE-2026-32281

What is CVE-2026-32281?

A vulnerability exists in Go's certificate chain validation process that can lead to denial of service. This issue arises when validating certificate chains that contain an excessive number of policy mappings, resulting in inefficient processing. The vulnerability affects trusted certificate chains that are either part of the VerifyOptions.Roots CertPool or included in the system certificate pool. If an attacker exploits this inefficiency, it could cause system instability and service interruptions.

References