VulnerabilityAwaiting Analysis

CVE-2026-27145

This caused strings.Split(host, ".") to execute repeatedly on the same input hostname.

MEDIUM 6.5EPSS 0.59%

Does this matter?

Lower severity and a low EPSS score (0.59%). Track it; it rarely justifies an emergency change on its own.

Description

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS: 0.59% probability · 46th percentile
CISA KEV: Not listed
Weakness: CWE-606
Source: security@golang.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.