The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade golang | Mar 2, 2020 | Dec 14, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 14, 2018 |
| Arista Eos | — | Upgrade to remediated software versions. | Sep 4, 2024 | Jan 16, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Dec 21, 2018 | Dec 14, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-binUpgrade golangUpgrade golang-src | Jan 3, 2020 | Dec 14, 2018 |
| Oracle Solaris | — | Upgrade system/library/gcc/gcc-gfortran-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gobjc to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-c-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gfortran-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gfortran-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gfortran to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-go-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-c-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gobjc-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-c++ to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gobjc-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-go-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-common-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gobjc-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-go-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-go to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-c-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Dec 14, 2018 |
| Oracle_linux | — | Upgrade kubeadm-ha-setupUpgrade kubernetes-cni-pluginsUpgrade kubeletUpgrade kubeadmUpgrade kubernetesUpgrade kubeadm-upgradeUpgrade kubectlUpgrade kubernetes-cni | Apr 14, 2019 | Dec 14, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 14, 2018 |
| Suse | — | Upgrade goUpgrade golang-github-docker-libnetwork-kubicUpgrade containerd-kubic-testUpgrade helm-mirrorUpgrade docker-runc-kubic-testUpgrade docker-kubicUpgrade go1.10-raceUpgrade go-docUpgrade docker-runcUpgrade golang-packagingUpgrade containerd-kubic-ctrUpgrade go1.12-raceUpgrade containerd-ctrUpgrade docker-kubic-zsh-completionUpgrade docker-bash-completionUpgrade docker-zsh-completionUpgrade golang-github-docker-libnetworkUpgrade containerd-testUpgrade docker-kubic-testUpgrade runc-testUpgrade go1.11Upgrade docker-libnetworkUpgrade docker-testUpgrade go1.12-docUpgrade docker-runc-testUpgrade docker-libnetwork-kubicUpgrade go1.11-docUpgrade go-raceUpgrade docker-runc-kubicUpgrade docker-kubic-bash-completionUpgrade go1.11-raceUpgrade helmUpgrade containerd-kubicUpgrade go1.10-docUpgrade docker-fish-completionUpgrade runcUpgrade go1.12Upgrade containerdUpgrade dockerUpgrade go1.10 | Dec 20, 2018 | Dec 14, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 14, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 14, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub