CVE-2026-32281: Inefficient policy validation in crypto/x509
Inefficient policy validation in crypto/x509
Other sources
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.25.9-r0 - Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.2-r0 - Upgrade
Upgrade
alpine/rcloneto a version that resolves this vulnerability.Fixed in 1.73.5-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32281?
CVE-2026-32281 is considered a denial of service vulnerability due to inefficient policy validation in the Go crypto/x509 library.
How do I fix CVE-2026-32281?
To fix CVE-2026-32281, upgrade to Go version 1.26.2 or later, as previous versions contain the vulnerability.
What software is affected by CVE-2026-32281?
CVE-2026-32281 affects the Go crypto/x509 library, specifically versions prior to 1.26.2 and those up to 1.25.9.
How can CVE-2026-32281 impact my application?
CVE-2026-32281 can cause denials of service due to inefficient validation of certificate chains with many policy mappings.
Is there a workaround for CVE-2026-32281 before upgrading?
There are no officially recommended workarounds for CVE-2026-32281, so upgrading to a patched version is advised.