Crypto/X509
Approved changes feed: RSS · Atom
cpe:2.3:a:go_standard_library:crypto/x509:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Go Standard Library (50bc78d3-15d0-59a4-bc22-a964570e0614) |
|---|---|
| Product | Crypto/X509 (21b83ce7-5094-5dcb-bdb3-47a309a85ddd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-33810 |
vulnerable | 2026-06-08 07:59:11.251122 |
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
Published: 2026-04-08T01:06:56.546Z
Updated: 2026-07-30T12:05:04.651Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32281 |
vulnerable | 2026-06-08 07:57:17.344423 |
Inefficient policy validation in crypto/x509
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
Published: 2026-04-08T01:06:58.354Z
Updated: 2026-04-13T18:19:44.779Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32280 |
vulnerable | 2026-06-08 07:57:17.343298 |
Unexpected work during chain building in crypto/x509
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
Published: 2026-04-08T01:06:58.595Z
Updated: 2026-07-31T12:04:44.703Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27145 |
vulnerable | 2026-06-08 07:53:21.973830 |
Inefficient candidate hostname parsing in crypto/x509
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
Published: 2026-06-02T22:01:36.954Z
Updated: 2026-07-31T12:04:46.218Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27138 |
vulnerable | 2026-06-08 07:53:21.964715 |
Panic in name constraint checking for malformed certificates in crypto/x509
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.
Published: 2026-03-06T21:28:14.000Z
Updated: 2026-03-10T13:35:19.784Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27137 |
vulnerable | 2026-06-08 07:53:21.964253 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-61729 |
vulnerable | 2026-06-08 07:37:27.961074 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-61727 |
vulnerable | 2026-06-08 07:37:27.958723 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-58188 |
vulnerable | 2026-06-08 07:35:17.424178 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-58187 |
vulnerable | 2026-06-08 07:35:17.423764 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22874 |
vulnerable | 2026-06-08 07:10:54.943533 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22865 |
vulnerable | 2026-06-08 07:10:54.927945 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45341 |
vulnerable | 2026-06-08 06:48:05.941875 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-24783 |
vulnerable | 2026-06-08 06:29:41.747911 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.