What is CVE-2026-27145?

CVE-2026-27145 is a medium-severity vulnerability in Go Standard Library Crypto/x509, classified under CWE-606. CVSS score: 6.5/10. Published 2026-06-02.

How severe is CVE-2026-27145?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2026-27145 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Go Standard Library Crypto/x509

CVE-2026-27145

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

EPSS: 0.006 (46.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H.

Affected products

Go Standard Library Crypto/x509 — versions 0, 1.26.0-0

Weakness classification (CWE)

CWE-606

Public proof-of-concept exploits

HORKimhab/CVE-2026-27145

References

Frequently asked questions

What is CVE-2026-27145?: CVE-2026-27145 is a medium-severity vulnerability in Go Standard Library Crypto/x509, classified under CWE-606. CVSS score: 6.5/10. Published 2026-06-02.
How severe is CVE-2026-27145?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2026-27145 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.