{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27145", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-02-17T19:57:28.435Z", "datePublished": "2026-06-02T22:01:36.954Z", "dateUpdated": "2026-06-30T02:41:53.540Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-06-02T22:01:36.954Z"}, "title": "Inefficient candidate hostname parsing in crypto/x509", "descriptions": [{"lang": "en", "value": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."}], "affected": [{"vendor": "Go standard library", "product": "crypto/x509", "collectionURL": "https://pkg.go.dev", "packageName": "crypto/x509", "versions": [{"version": "0", "lessThan": "1.25.11", "status": "affected", "versionType": "semver"}, {"version": "1.26.0-0", "lessThan": "1.26.4", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "HostnameError.Error"}, {"name": "matchHostnames"}, {"name": "Certificate.Verify"}, {"name": "Certificate.VerifyHostname"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}], "references": [{"url": "https://go.dev/cl/783621"}, {"url": "https://go.dev/issue/79694"}, {"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5037"}], "credits": [{"lang": "en", "value": "Jakub Ciolek - https://ciolek.dev/"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T12:34:03.859208Z", "id": "CVE-2026-27145", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T12:34:53.136Z"}}, {"affected": [{"cpes": ["cpe:/a:redhat:assisted_installer:2"], "defaultStatus": "affected", "product": "Assisted Installer for Red Hat OpenShift Container Platform 2", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_builds:1"], "defaultStatus": "affected", "product": "Builds for Red Hat OpenShift", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:cert_manager:1"], "defaultStatus": "affected", "product": "cert-manager Operator for Red Hat OpenShift", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_compliance_operator:1"], "defaultStatus": "affected", "product": "Compliance Operator", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:confidential_compute_attestation:1"], "defaultStatus": "affected", "product": "Confidential Compute Attestation", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:deployment_validator_operator"], "defaultStatus": "affected", "product": "Deployment Validation Operator", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:external_secrets_operator:1"], "defaultStatus": "affected", "product": "External Secrets Operator for Red Hat OpenShift", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:workload_availability_far:0"], "defaultStatus": "affected", "product": "Fence Agents Remediation Operator", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_file_integrity_operator:1"], "defaultStatus": "affected", "product": "File Integrity Operator", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:workload_availability_mdr:0"], "defaultStatus": "affected", "product": "Machine Deletion Remediation Operator", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:rhmt:1"], "defaultStatus": "affected", "product": "Migration Toolkit for Containers", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:multiarch_tuning_operator"], "defaultStatus": "affected", "product": "Multiarch Tuning Operator", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:multicluster_globalhub"], "defaultStatus": "affected", "product": "Multicluster Global Hub", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:network_observ_optr:1"], "defaultStatus": "affected", "product": "Network Observability Operator", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:workload_availability_nhc:0"], "defaultStatus": "affected", "product": "Node HealthCheck Operator", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_api_data_protection:1"], "defaultStatus": "affected", "product": "OpenShift API for Data Protection", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_lightspeed"], "defaultStatus": "affected", "product": "OpenShift Lightspeed", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:service_mesh:2"], "defaultStatus": "affected", "product": "OpenShift Service Mesh 2", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:service_mesh:3"], "defaultStatus": "affected", "product": "OpenShift Service Mesh 3", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:source_to_image:1"], "defaultStatus": "affected", "product": "OpenShift Source-to-Image (S2I)", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_power_monitoring"], "defaultStatus": "affected", "product": "Power monitoring for Red Hat OpenShift", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:red_hat_3scale_amp:2"], "defaultStatus": "affected", "product": "Red Hat 3scale API Management Platform 2", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:acm:2"], "defaultStatus": "affected", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "defaultStatus": "affected", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:ceph_storage:5"], "defaultStatus": "affected", "product": "Red Hat Ceph Storage 5", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:ceph_storage:6"], "defaultStatus": "affected", "product": "Red Hat Ceph Storage 6", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:connectivity_link:1"], "defaultStatus": "affected", "product": "Red Hat Connectivity Link 1", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:rhdh:1"], "defaultStatus": "affected", "product": "Red Hat Developer Hub", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:edge_manager:1"], "defaultStatus": "affected", "product": "Red Hat Edge Manager 1", "vendor": "Red Hat"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "affected", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "affected", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "affected", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "affected", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:lightspeed_for_runtimes:1"], "defaultStatus": "affected", "product": "Red Hat Lightspeed for Runtimes Operator", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_cluster_manager_cli:1"], "defaultStatus": "affected", "product": "Red Hat OpenShift Cluster Manager CLI", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "affected", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:devworkspace"], "defaultStatus": "affected", "product": "Red Hat OpenShift Dev Workspaces Operator", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_service_on_aws:1"], "defaultStatus": "affected", "product": "Red Hat OpenShift on AWS", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4"], "defaultStatus": "affected", "product": "Red Hat OpenShift Virtualization 4", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openstack:16.2"], "defaultStatus": "affected", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openstack:17.1"], "defaultStatus": "affected", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openstack:18.0"], "defaultStatus": "affected", "product": "Red Hat OpenStack Platform 18.0", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:satellite:6"], "defaultStatus": "affected", "product": "Red Hat Satellite 6", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:trusted_artifact_signer:1"], "defaultStatus": "affected", "product": "Red Hat Trusted Artifact Signer", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:webterminal:1"], "defaultStatus": "affected", "product": "Red Hat Web Terminal", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_security_profiles_operator:1"], "defaultStatus": "affected", "product": "Security Profiles Operator", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:amq_streams:2"], "defaultStatus": "affected", "product": "streams for Apache Kafka 2", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:amq_streams:3"], "defaultStatus": "affected", "product": "streams for Apache Kafka 3", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:zero_trust_workload_identity_manager:1"], "defaultStatus": "affected", "product": "Zero Trust Workload Identity Manager", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:zero_trust_workload_identity_manager:0"], "defaultStatus": "affected", "product": "Zero Trust Workload Identity Manager - Tech Preview", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:cryostat:4"], "defaultStatus": "unaffected", "product": "Cryostat 4", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_custom_metrics_autoscaler:2"], "defaultStatus": "unaffected", "product": "Custom Metric Autoscaler operator for Red Hat Openshift", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:gatekeeper:3"], "defaultStatus": "unaffected", "product": "Gatekeeper 3", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:logging:6"], "defaultStatus": "unaffected", "product": "Logging Subsystem for Red Hat OpenShift", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:lvms:4"], "defaultStatus": "unaffected", "product": "Logical Volume Manager Storage", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:migration_toolkit_applications:8"], "defaultStatus": "unaffected", "product": "Migration Toolkit for Applications 8", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:mirror_registry:2"], "defaultStatus": "unaffected", "product": "mirror registry for Red Hat OpenShift 2", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:multicluster_engine"], "defaultStatus": "unaffected", "product": "Multicluster Engine for Kubernetes", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:ocp_tools"], "defaultStatus": "unaffected", "product": "OpenShift Developer Tools and Services", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:advanced_cluster_security:4"], "defaultStatus": "unaffected", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:ceph_storage:7"], "defaultStatus": "unaffected", "product": "Red Hat Ceph Storage 7", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:ceph_storage:8"], "defaultStatus": "unaffected", "product": "Red Hat Ceph Storage 8", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:ceph_storage:9"], "defaultStatus": "unaffected", "product": "Red Hat Ceph Storage 9", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4"], "defaultStatus": "unaffected", "product": "Red Hat Openshift Data Foundation 4", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "unaffected", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3"], "defaultStatus": "unaffected", "product": "Red Hat OpenShift distributed tracing 3", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:windows_machine_config"], "defaultStatus": "unaffected", "product": "Red Hat OpenShift for Windows Containers", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "unaffected", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:quay:3"], "defaultStatus": "unaffected", "product": "Red Hat Quay 3", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:service_interconnect:2"], "defaultStatus": "unaffected", "product": "Red Hat Service Interconnect 2", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:stf:1.5"], "defaultStatus": "unaffected", "product": "Service Telemetry Framework 1.5", "vendor": "Red Hat"}], "datePublic": "2026-06-02T22:01:36.954Z", "descriptions": [{"lang": "en", "value": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-606", "description": "Unchecked Input for Loop Condition", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-27145"}, {"name": "RHBZ#2484207", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json"}], "timeline": [{"lang": "en", "time": "2026-06-02T23:01:08.992Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-02T22:01:36.954Z", "value": "Made public."}], "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries", "workarounds": [{"lang": "en", "value": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037)."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-06-30T02:41:53.540Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-27145", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T12:34:03.859208Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T12:34:49.559Z"}}], "cna": {"title": "Inefficient candidate hostname parsing in crypto/x509", "credits": [{"lang": "en", "value": "Jakub Ciolek - https://ciolek.dev/"}], "affected": [{"vendor": "Go standard library", "product": "crypto/x509", "versions": [{"status": "affected", "version": "0", "lessThan": "1.25.11", "versionType": "semver"}, {"status": "affected", "version": "1.26.0-0", "lessThan": "1.26.4", "versionType": "semver"}], "packageName": "crypto/x509", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "HostnameError.Error"}, {"name": "matchHostnames"}, {"name": "Certificate.Verify"}, {"name": "Certificate.VerifyHostname"}]}], "references": [{"url": "https://go.dev/cl/783621"}, {"url": "https://go.dev/issue/79694"}, {"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5037"}], "descriptions": [{"lang": "en", "value": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-06-02T22:01:36.954Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27145", "state": "PUBLISHED", "dateUpdated": "2026-06-04T12:34:53.136Z", "dateReserved": "2026-02-17T19:57:28.435Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-06-02T22:01:36.954Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."}], "id": "CVE-2026-27145", "lastModified": "2026-06-04T16:15:50.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-06-02T23:16:35.570", "references": [{"source": "security@golang.org", "url": "https://go.dev/cl/783621"}, {"source": "security@golang.org", "url": "https://go.dev/issue/79694"}, {"source": "security@golang.org", "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"}, {"source": "security@golang.org", "url": "https://pkg.go.dev/vuln/GO-2026-5037"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Awaiting Analysis"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.25.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.26.0-0,1.26.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "crypto/x509", "source": "cna", "vendor": "Go standard library"}, "product": "crypto/x509", "vendor": "go_standard_library"}], "created": "2026-06-03T04:00:11.282059+00:00", "updated": "2026-06-04T16:00:17.819810+00:00", "vendors": ["go_standard_library", "go_standard_library$PRODUCT$crypto/x509"], "weaknesses": ["CWE-400"]}