Detections
Analytics
CVE-2026-27145
high
Description
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
References
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json
https://pkg.go.dev/vuln/GO-2026-5037
https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
https://bugzilla.redhat.com/show_bug.cgi?id=2484207
https://access.redhat.com/security/cve/CVE-2026-27145
https://access.redhat.com/errata/RHSA-2026:57194
https://access.redhat.com/errata/RHSA-2026:55899
https://access.redhat.com/errata/RHSA-2026:54757
https://access.redhat.com/errata/RHSA-2026:54603
https://access.redhat.com/errata/RHSA-2026:54531
https://access.redhat.com/errata/RHSA-2026:54525
https://access.redhat.com/errata/RHSA-2026:54500
https://access.redhat.com/errata/RHSA-2026:54441
https://access.redhat.com/errata/RHSA-2026:54435
https://access.redhat.com/errata/RHSA-2026:54432
https://access.redhat.com/errata/RHSA-2026:54427
https://access.redhat.com/errata/RHSA-2026:54401
https://access.redhat.com/errata/RHSA-2026:54168
https://access.redhat.com/errata/RHSA-2026:53530
https://access.redhat.com/errata/RHSA-2026:53416
https://access.redhat.com/errata/RHSA-2026:53415
https://access.redhat.com/errata/RHSA-2026:53413
https://access.redhat.com/errata/RHSA-2026:53412
https://access.redhat.com/errata/RHSA-2026:53374
https://access.redhat.com/errata/RHSA-2026:52946
https://access.redhat.com/errata/RHSA-2026:51187
https://access.redhat.com/errata/RHSA-2026:51057
https://access.redhat.com/errata/RHSA-2026:50319
https://access.redhat.com/errata/RHSA-2026:50205
https://access.redhat.com/errata/RHSA-2026:49770
https://access.redhat.com/errata/RHSA-2026:49765
https://access.redhat.com/errata/RHSA-2026:49744
https://access.redhat.com/errata/RHSA-2026:49729
https://access.redhat.com/errata/RHSA-2026:49705
https://access.redhat.com/errata/RHSA-2026:49703
https://access.redhat.com/errata/RHSA-2026:47737
https://access.redhat.com/errata/RHSA-2026:47735
https://access.redhat.com/errata/RHSA-2026:47149
https://access.redhat.com/errata/RHSA-2026:46395
https://access.redhat.com/errata/RHSA-2026:46394
https://access.redhat.com/errata/RHSA-2026:44622
https://access.redhat.com/errata/RHSA-2026:42946
https://access.redhat.com/errata/RHSA-2026:42644
https://access.redhat.com/errata/RHSA-2026:42240
https://access.redhat.com/errata/RHSA-2026:42151
https://access.redhat.com/errata/RHSA-2026:42150
https://access.redhat.com/errata/RHSA-2026:42142
https://access.redhat.com/errata/RHSA-2026:42082
https://access.redhat.com/errata/RHSA-2026:42080
https://access.redhat.com/errata/RHSA-2026:42079
https://access.redhat.com/errata/RHSA-2026:42051
https://access.redhat.com/errata/RHSA-2026:42050
https://access.redhat.com/errata/RHSA-2026:42049
https://access.redhat.com/errata/RHSA-2026:42047
https://access.redhat.com/errata/RHSA-2026:42043
https://access.redhat.com/errata/RHSA-2026:41930
https://access.redhat.com/errata/RHSA-2026:41036
https://access.redhat.com/errata/RHSA-2026:41030
https://access.redhat.com/errata/RHSA-2026:39879
https://access.redhat.com/errata/RHSA-2026:39573
https://access.redhat.com/errata/RHSA-2026:39005
https://access.redhat.com/errata/RHSA-2026:38995
https://access.redhat.com/errata/RHSA-2026:36797
https://access.redhat.com/errata/RHSA-2026:36648
https://access.redhat.com/errata/RHSA-2026:36317
https://access.redhat.com/errata/RHSA-2026:35832
https://access.redhat.com/errata/RHSA-2026:34359
https://access.redhat.com/errata/RHSA-2026:34357
https://access.redhat.com/errata/RHSA-2026:33574
https://access.redhat.com/errata/RHSA-2026:29981
https://access.redhat.com/errata/RHSA-2026:29980