During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
References
| Link | Resource |
|---|---|
| https://go.dev/cl/758320 | Patch |
| https://go.dev/issue/78282 | Issue Tracking |
| https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU | Release Notes Mailing List |
| https://pkg.go.dev/vuln/GO-2026-4947 | Vendor Advisory |
Configurations
History
16 Apr 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Golang go
Golang |
|
| CPE | cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | |
| References | () https://go.dev/cl/758320 - Patch | |
| References | () https://go.dev/issue/78282 - Issue Tracking | |
| References | () https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU - Release Notes, Mailing List | |
| References | () https://pkg.go.dev/vuln/GO-2026-4947 - Vendor Advisory |
08 Apr 2026, 19:25
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-770 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
08 Apr 2026, 02:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-08 02:16
Updated : 2026-04-16 19:16
NVD link : CVE-2026-32280
Mitre link : CVE-2026-32280
CVE.ORG link : CVE-2026-32280
JSON object : View
Products Affected
golang
- go
CWE
CWE-770
Allocation of Resources Without Limits or Throttling