CVE-2026-27145: Go Standard Library crypto/x509

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

Affected products

Go Standard Library crypto/x509: before 1.25.11 (fixed in 1.25.11); from 1.26.0-0, before 1.26.4 (fixed in 1.26.4)
Red Hat Assisted Installer For Red Hat Openshift Container Platform 2
Red Hat Cert Manager Support For Red Hat Openshift Release 1.19: before 1786613805 (fixed in 1786613805)
Red Hat Cluster Observability Operator 1.5.0: before 1787593946 (fixed in 1787593946)
Red Hat Compliance Operator 1: before 1786380082 (fixed in 1786380082)
Red Hat Confidential Compute Attestation
Red Hat Cryostat 4
Red Hat Custom Metric Autoscaler Operator For Red Hat Openshift
Red Hat Deployment Validation Operator
Red Hat External Secrets Operator For Red Hat Openshift 1.1: before 1786614676 (fixed in 1786614676)
Red Hat Externaldns Operator
Red Hat Fence Agents Remediation Operator
Red Hat File Integrity Operator
Red Hat Gatekeeper 3
Red Hat Logging Subsystem For Red Hat Openshift
Red Hat Logical Volume Manager Storage
Red Hat Machine Deletion Remediation Operator
Red Hat Migration Toolkit For Applications 8
Red Hat Migration Toolkit For Containers
Red Hat Mirror Registry For Red Hat Openshift 2
Red Hat Multiarch Tuning Operator
Red Hat Multicluster Engine For Kubernetes
Red Hat Multicluster Engine For Kubernetes 2.1: before 1786549223 (fixed in 1786549223); before 1787201612 (fixed in 1787201612); before 1786764622 (fixed in 1786764622); before 1787176886 (fixed in 1787176886)
Red Hat Multicluster Engine For Kubernetes 2.11: before 1786911941 (fixed in 1786911941); before 1786911952 (fixed in 1786911952); before 1786911945 (fixed in 1786911945); before 1786912006 (fixed in 1786912006); before 1786911973 (fixed in 1786911973); before 1786911950 (fixed in 1786911950); …
Red Hat Multicluster Engine For Kubernetes 2.17: before 1786577950 (fixed in 1786577950); before 1786750700 (fixed in 1786750700); before 1786983362 (fixed in 1786983362); before 1786664288 (fixed in 1786664288)
and 106 more

Published 2026-06-02. Last modified 2026-09-18.