CVE-2025-58187

CWE-407CWE-770 — Allocation without Limits9 documents8 sources
Severity
7.5HIGH
EPSS
0.0%
top 95.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GO Standard Library Crypto/x509Golang GO
Timeline
PublishedOct 29
Latest updateOct 30

Description

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶Gostdlib1.25.0 — 1.25.3+1
▶NVDgolang/go1.25.0 — 1.25.3+1
▶CVEListV5go_standard_library/crypto/x5091.25.0 — 1.25.3+1
▶Debiangolang-1.24< 1.24.8-1
▶Debiangolang-1.25< 1.25.2-1

Patches

Patch: go.dev ↗

🔴Vulnerability Details

4
GHSA
GHSA-frhw-mqj2-wxw2: Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the cer↗2025-10-30
▶
OSV
Quadratic complexity when checking name constraints in crypto/x509↗2025-10-29
▶
OSV
CVE-2025-58187: Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the cer↗2025-10-29
▶
CVEList
Quadratic complexity when checking name constraints in crypto/x509↗2025-10-29
▶

📋Vendor Advisories

3
Red Hat
crypto/x509: Quadratic complexity when checking name constraints in crypto/x509↗2025-10-29
▶
Microsoft
Quadratic complexity when checking name constraints in crypto/x509↗2025-10-14
▶
Debian
CVE-2025-58187: golang-1.15 - Due to the design of the name constraint checking algorithm, the processing time...↗2025
▶

💬Community

1
Bugzilla
CVE-2025-58187 crypto/x509: Quadratic complexity when checking name constraints in crypto/x509↗2025-10-29
▶