CVE-2026-32281 — Excessive Platform Resource Consumption within a Loop in Standard Library Crypto X509

CWE-1050 — Excessive Platform Resource Consumption within a Loop11 documents9 sources
Severity
7.5HIGHNVD
EPSS
0.0%
top 94.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GO Standard Library Crypto X509
Timeline
PublishedApr 8
Latest updateApr 13

Description

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶CVEListV5go_standard_library/crypto_x5091.26.0-0 — 1.26.2+1

🔴Vulnerability Details

5
VulDB
crypto-x509 up to 1.25.8/1.26.1 on Go Certificate algorithmic complexity (Nessus ID 305623 / WID-SEC-2026-1006)↗2026-04-13
▶
CVEList
Inefficient policy validation in crypto/x509↗2026-04-08
▶
OSV
CVE-2026-32281: Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mapp↗2026-04-08
▶
GHSA
GHSA-gjvh-7jh8-7xhm: Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mapp↗2026-04-08
▶
OSV
Inefficient policy validation in crypto/x509↗2026-04-07
▶

📋Vendor Advisories

2
Red Hat
crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation↗2026-04-08
▶
Debian
CVE-2026-32281: golang-1.15 - Validating certificate chains which use policies is unexpectedly inefficient whe...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-32281 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

2
Bugzilla
CVE-2026-32281 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation↗2026-04-08
▶
Bugzilla
CVE-2026-32281 golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation [fedora-all]↗2026-04-08
▶
CVE-2026-32281 — HIGH severity | cvebase