CVE-2026-27145: Go x509 Certificate Verification Denial-of-Service Flaw

Technical summary

CVE-2026-27145 is a ReDoS-adjacent algorithmic complexity vulnerability in Go's x509.Certificate.VerifyHostname method. The function iterates over all DNS SAN entries and calls matchHostnames for each one. Inside that loop, matchHostnames invokes strings.Split(host, ".") on the input hostname—a O(n) operation repeated m times, where m is the SAN count. Hostname labels typically range from 2–6 parts; a malicious certificate could contain thousands of SAN entries. The quadratic cost (O(m × n)) compounds because x509.Verify performs hostname validation before building and validating the certificate chain, meaning attackers need not present a valid cert signature to trigger the overhead. CWE-606 (Unchecked Input) categorizes the root cause: no bounds checking on SAN list size.

Business impact

This vulnerability enables denial-of-service attacks against any Go application using x509 certificate verification—including TLS clients, API gateways, and certificate-based authentication systems. An attacker can send a specially crafted certificate with thousands of DNS SANs, causing the verification routine to consume excessive CPU and delay or timeout legitimate connection attempts. In high-throughput environments (API servers, load balancers, reverse proxies), a single malicious certificate can degrade service for all users. Because the overhead occurs before signature validation, attackers do not need to compromise a real CA; they can craft and distribute the certificate freely. Organizations processing untrusted certificates (e.g., web scrapers, security appliances) face the highest risk.

Affected systems

All Go applications and libraries using the standard library's crypto/x509 package for certificate validation are affected. No specific vendor or product versions are listed in the CVE record; however, any Go runtime or compiled binary that calls x509.Certificate.VerifyHostname or x509.Verify on untrusted input is vulnerable. This includes: TLS clients in Go 1.x versions prior to the patch; web services performing certificate pinning or validation; microservices using mTLS; Go-based reverse proxies and API gateways; and third-party Go libraries wrapping x509 verification. Organizations should verify the Go compiler version and patch status of deployed binaries.

Exploitability

Exploitability is moderate to high. An attacker must craft and deliver a valid X.509 certificate bearing an unusually large DNS SAN extension. Tools for certificate generation (OpenSSL, cfssl) allow SAN list manipulation, making creation trivial. Delivery requires the target application to attempt verification of the attacker's certificate—feasible in open TLS scenarios (public APIs, client-certificate authentication, certificate pinning) and in applications that validate untrusted certs from external sources. No user interaction or special privileges are required. However, exploitation requires the attacker to send the certificate and have the target application call the vulnerable code path, which depends on application design.

Remediation

Upgrade to a patched version of Go. The Go project released security updates that optimize x509.VerifyHostname to avoid redundant string splitting. The fix computes the hostname label split once, outside the loop, eliminating the quadratic complexity. Users must rebuild and redeploy applications with the patched Go runtime. Since this is a runtime library issue, patching the Go compiler version used in your build pipeline is necessary; recompiling existing binaries with the new version will pick up the fix. Verify the specific patch version against the official Go security advisory.

Patch guidance

Determine which Go version(s) are in use by running `go version` on developer machines and inspecting deployed binaries. Consult the official Go security advisory (security.go.dev) for the minimum patched version for each Go major release (e.g., 1.21.x, 1.22.x). Update your Go toolchain and rebuild all applications and static binaries. If using containerized deployments, rebuild images with the patched Go base layer. For library maintainers, consider upgrading Go and releasing a new version; inform downstream consumers. Verify patch effectiveness by running a test certificate with a large SAN list against a test endpoint to confirm verification completes quickly.

Detection guidance

Monitor for: (1) Elevated CPU usage on certificate validation services or TLS endpoints during baseline operations, especially correlated with incoming TLS handshakes; (2) Timeout or slowness in certificate verification logs; (3) Anomalous certificate submissions with unusually large SAN extensions (detect via certificate chain inspection in logs or packet capture—look for SAN lists >1000 entries); (4) Denial-of-service patterns against services that validate user-supplied certificates. Instrumentation: add timing metrics around x509.Verify calls. In Go, use pprof or custom defer timing to identify slow verifications. Log the SAN count and hostname being validated to correlate spikes with malicious certificates.

Why prioritize this

CVSS 6.5 (MEDIUM) reflects the denial-of-service impact (Availability, A:H) and integrity ambiguity (I:L—timing attacks could theoretically leak info), but the attack requires active delivery of a crafted certificate and does not break confidentiality or enable remote code execution. Prioritization should be elevated if: your application validates untrusted certificates from the internet (high attack surface); you run high-availability services where latency degradation is business-critical; you operate certificate pinning or client-authentication TLS endpoints. Prioritize lower if certificates are only validated in private, controlled environments (e.g., internal mTLS with known CAs).

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) derives from: Network vector (AV:N—attacker is remote), High complexity (AC:H—requires crafted certificate), Availability impact (A:H—DoS via CPU exhaustion), and Integrity impact (I:L—potential timing side-channel). Confidentiality is not affected (C:N). The complexity modifier reflects that exploitation is feasible but requires deliberate certificate construction and delivery. In threat models emphasizing availability and resilience, this score may underestimate business risk; organizations with strict uptime SLAs should treat this as a higher priority.

Frequently asked questions