Detections
Analytics
CVE-2026-27145
high
Description
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
References
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json
https://pkg.go.dev/vuln/GO-2026-5037
https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
https://bugzilla.redhat.com/show_bug.cgi?id=2484207
https://access.redhat.com/security/cve/CVE-2026-27145
https://access.redhat.com/errata/RHSA-2026:47737
https://access.redhat.com/errata/RHSA-2026:47735
https://access.redhat.com/errata/RHSA-2026:47149
https://access.redhat.com/errata/RHSA-2026:46395
https://access.redhat.com/errata/RHSA-2026:46394
https://access.redhat.com/errata/RHSA-2026:44622
https://access.redhat.com/errata/RHSA-2026:42946
https://access.redhat.com/errata/RHSA-2026:42644
https://access.redhat.com/errata/RHSA-2026:42240
https://access.redhat.com/errata/RHSA-2026:42151
https://access.redhat.com/errata/RHSA-2026:42150
https://access.redhat.com/errata/RHSA-2026:42142
https://access.redhat.com/errata/RHSA-2026:42082
https://access.redhat.com/errata/RHSA-2026:42080
https://access.redhat.com/errata/RHSA-2026:42079
https://access.redhat.com/errata/RHSA-2026:42051
https://access.redhat.com/errata/RHSA-2026:42050
https://access.redhat.com/errata/RHSA-2026:42049
https://access.redhat.com/errata/RHSA-2026:42047
https://access.redhat.com/errata/RHSA-2026:42043
https://access.redhat.com/errata/RHSA-2026:41930
https://access.redhat.com/errata/RHSA-2026:41036
https://access.redhat.com/errata/RHSA-2026:41030
https://access.redhat.com/errata/RHSA-2026:39879
https://access.redhat.com/errata/RHSA-2026:39573
https://access.redhat.com/errata/RHSA-2026:39005
https://access.redhat.com/errata/RHSA-2026:38995
https://access.redhat.com/errata/RHSA-2026:36797
https://access.redhat.com/errata/RHSA-2026:36648
https://access.redhat.com/errata/RHSA-2026:36317
https://access.redhat.com/errata/RHSA-2026:35832
https://access.redhat.com/errata/RHSA-2026:34359
https://access.redhat.com/errata/RHSA-2026:34357
https://access.redhat.com/errata/RHSA-2026:33574
https://access.redhat.com/errata/RHSA-2026:29981
https://access.redhat.com/errata/RHSA-2026:29980