(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golangUpgrade golang-miscUpgrade golang-srcUpgrade golang-testsUpgrade golang-raceUpgrade skopeoUpgrade golang-docsUpgrade golang-binUpgrade delveUpgrade go-toolsetUpgrade skopeo-testsUpgrade opentelemetry-collector | Jul 7, 2026 | Jul 1, 2026 |
| Amazon Linux Ami 2 | — | Upgrade nerdctlUpgrade golistUpgrade amazon-cloudwatch-agentUpgrade golang-sharedUpgrade ecs-initUpgrade containerdUpgrade containerd-debuginfoUpgrade golist-debuginfoUpgrade docker-debuginfoUpgrade golang-docsUpgrade nerdctl-debuginfoUpgrade golang-miscUpgrade golang-testsUpgrade dockerUpgrade golangUpgrade golang-srcUpgrade soci-snapshotterUpgrade containerd-stressUpgrade golang-bin | Jun 23, 2026 | Jun 23, 2026 |
| Amazon_linux_2023 | — | Upgrade golang-github-cpuguy83-md2manUpgrade containerd-stressUpgrade credentials-fetcherUpgrade golang-github-burntsushi-toml-test-develUpgrade golang-github-burntsushi-toml-testUpgrade golang-github-burntsushi-tomlUpgrade golang-docsUpgrade golang-github-cpuguy83-md2man-develUpgrade docker-debuginfoUpgrade docker-debugsourceUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade soci-snapshotterUpgrade containerd-stress-debuginfoUpgrade golang-srcUpgrade amazon-cloudwatch-agentUpgrade golist-debuginfoUpgrade golangUpgrade containerd-debuginfoUpgrade nerdctlUpgrade golang-github-burntsushi-toml-test-debuginfoUpgrade golang-github-burntsushi-toml-debugsourceUpgrade golang-binUpgrade golang-github-burntsushi-toml-test-debugsourceUpgrade ecs-initUpgrade golist-debugsourceUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-miscUpgrade golistUpgrade golang-sharedUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade containerd-debugsourceUpgrade golang-testsUpgrade dockerUpgrade containerdUpgrade golang-github-burntsushi-toml-develUpgrade golang-github-burntsushi-toml-debuginfo | Jun 23, 2026 | Jun 2, 2026 |
| Redhat Openshift | — | Upgrade butane | Aug 27, 2026 | Jun 2, 2026 |
| Redhat_linux | — | Upgrade flightctl-observabilityUpgrade rhcUpgrade flightctl-selinuxUpgrade rhc-develUpgrade delve-debuginfoUpgrade opentelemetry-collectorUpgrade go-fdo-server-ownerUpgrade go-fdo-server-debuginfoUpgrade delveUpgrade go-fdo-server-manufacturerUpgrade golang-miscUpgrade skopeo-testsUpgrade rhc-debuginfoUpgrade host-metering-debuginfoUpgrade flightctl-agentUpgrade golang-raceUpgrade host-metering-selinuxUpgrade rhc-debugsourceUpgrade go-toolsetUpgrade rhc-worker-playbookUpgrade yggdrasilUpgrade go-fdo-serverUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade golang-srcUpgrade flightctl-cliUpgrade yggdrasil-develUpgrade go-fdo-client-debugsourceUpgrade delve-debugsourceUpgrade yggdrasil-examples-debuginfoUpgrade skopeo-debugsourceUpgrade golangUpgrade golang-binUpgrade go-fdo-server-rendezvousUpgrade rhc-worker-playbook-debugsourceUpgrade go-fdo-client-debuginfoUpgrade host-meteringUpgrade yggdrasil-debugsourceUpgrade go-fdo-server-debugsourceUpgrade golang-docsNo solution existsUpgrade flightctl-servicesUpgrade skopeo-debuginfoUpgrade host-metering-debugsourceUpgrade ipp-usb-debuginfoUpgrade golang-testsUpgrade go-fdo-clientUpgrade yggdrasil-debuginfoUpgrade ipp-usbUpgrade rhc-worker-playbook-debuginfoUpgrade skopeo | Jul 3, 2026 | Jun 2, 2026 |
| Rocky_linux | — | Upgrade golang-binUpgrade yggdrasil-debugsourceUpgrade ipp-usbUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade skopeo-debuginfoUpgrade yggdrasilUpgrade opentelemetry-collectorUpgrade ipp-usb-debuginfoUpgrade delveUpgrade skopeo-testsUpgrade go-toolsetUpgrade yggdrasil-debuginfoUpgrade golang-raceUpgrade yggdrasil-develUpgrade skopeoUpgrade skopeo-debugsourceUpgrade golangUpgrade delve-debugsourceUpgrade delve-debuginfo | Jul 7, 2026 | Jul 5, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 13, 2026 | Jun 2, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub