Veille CVE

Recherche « Go standard library crypto/x509 »

2 CVE

Critique 0 Élevée 0 Moyenne 1 Faible 0 Non évaluée 1 Exploitées (KEV) Tri : plus récentes « Go standard library crypto/x509 » ✕
  1. CVE-2026-111943 – Non évaluée

    Go standard library crypto/x509

    On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

  2. CVE-2026-27145 6.5 Moyenne

    Go standard library crypto/x509 · Red Hat Ansible Automation Platform 2.5 for RHEL 8 · Red Hat Ansible Automation Platform 2.5 for RHEL 9 · Red Hat Ansible Automation Platform 2.6 for RHEL 10

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.