CVE-2026-27145: Inefficient candidate hostname parsing in crypto/x509
(x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27145?
CVE-2026-27145 has a medium severity rating of 6.5 according to the CVSS 3.1 scoring system.
How does CVE-2026-27145 affect hostname verification?
CVE-2026-27145 causes inefficient hostname verification due to the repeated execution of string.Split on the input hostname for large DNS Subject Alternative Name (SAN) entries.
What are the consequences of CVE-2026-27145?
The consequences of CVE-2026-27145 include potentially significant performance degradation during hostname verification with large SAN lists.
How can CVE-2026-27145 be mitigated?
Mitigation of CVE-2026-27145 can be achieved by updating to the latest version of the go/crypto/x509 library that addresses the inefficient hostname parsing.
When was CVE-2026-27145 published?
CVE-2026-27145 was published on June 2, 2026.