During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:10217 cve-icon
https://access.redhat.com/errata/RHSA-2026:10219 cve-icon
https://access.redhat.com/errata/RHSA-2026:10704 cve-icon
https://access.redhat.com/errata/RHSA-2026:11507 cve-icon
https://access.redhat.com/errata/RHSA-2026:11514 cve-icon
https://access.redhat.com/errata/RHSA-2026:11688 cve-icon
https://access.redhat.com/errata/RHSA-2026:13545 cve-icon
https://access.redhat.com/errata/RHSA-2026:13791 cve-icon
https://access.redhat.com/errata/RHSA-2026:13826 cve-icon
https://access.redhat.com/errata/RHSA-2026:13829 cve-icon
https://access.redhat.com/errata/RHSA-2026:14020 cve-icon
https://access.redhat.com/errata/RHSA-2026:14162 cve-icon
https://access.redhat.com/errata/RHSA-2026:14200 cve-icon
https://access.redhat.com/errata/RHSA-2026:14391 cve-icon
https://access.redhat.com/errata/RHSA-2026:15980 cve-icon
https://access.redhat.com/errata/RHSA-2026:16021 cve-icon
https://access.redhat.com/errata/RHSA-2026:16024 cve-icon
https://access.redhat.com/errata/RHSA-2026:16101 cve-icon
https://access.redhat.com/errata/RHSA-2026:16476 cve-icon
https://access.redhat.com/errata/RHSA-2026:16477 cve-icon
https://access.redhat.com/errata/RHSA-2026:16505 cve-icon
https://access.redhat.com/errata/RHSA-2026:16508 cve-icon
https://access.redhat.com/errata/RHSA-2026:16532 cve-icon
https://access.redhat.com/errata/RHSA-2026:16534 cve-icon
https://access.redhat.com/errata/RHSA-2026:16535 cve-icon
https://access.redhat.com/errata/RHSA-2026:16537 cve-icon
https://access.redhat.com/errata/RHSA-2026:16542 cve-icon
https://access.redhat.com/errata/RHSA-2026:16874 cve-icon
https://access.redhat.com/errata/RHSA-2026:16875 cve-icon
https://access.redhat.com/errata/RHSA-2026:17084 cve-icon
https://access.redhat.com/errata/RHSA-2026:17287 cve-icon
https://access.redhat.com/errata/RHSA-2026:18027 cve-icon
https://access.redhat.com/errata/RHSA-2026:18032 cve-icon
https://access.redhat.com/errata/RHSA-2026:19133 cve-icon
https://access.redhat.com/errata/RHSA-2026:19135 cve-icon
https://access.redhat.com/errata/RHSA-2026:19144 cve-icon
https://access.redhat.com/errata/RHSA-2026:19350 cve-icon
https://access.redhat.com/errata/RHSA-2026:19353 cve-icon
https://access.redhat.com/errata/RHSA-2026:19375 cve-icon
https://access.redhat.com/errata/RHSA-2026:19450 cve-icon
https://access.redhat.com/errata/RHSA-2026:19550 cve-icon
https://access.redhat.com/errata/RHSA-2026:19634 cve-icon
https://access.redhat.com/errata/RHSA-2026:19714 cve-icon
https://access.redhat.com/errata/RHSA-2026:19715 cve-icon
https://access.redhat.com/errata/RHSA-2026:19719 cve-icon
https://access.redhat.com/errata/RHSA-2026:19720 cve-icon
https://access.redhat.com/errata/RHSA-2026:19721 cve-icon
https://access.redhat.com/errata/RHSA-2026:19722 cve-icon
https://access.redhat.com/errata/RHSA-2026:19750 cve-icon
https://access.redhat.com/errata/RHSA-2026:19839 cve-icon
https://access.redhat.com/errata/RHSA-2026:20556 cve-icon
https://access.redhat.com/errata/RHSA-2026:20569 cve-icon
https://access.redhat.com/errata/RHSA-2026:20570 cve-icon
https://access.redhat.com/errata/RHSA-2026:20571 cve-icon
https://access.redhat.com/errata/RHSA-2026:20607 cve-icon
https://access.redhat.com/errata/RHSA-2026:20608 cve-icon
https://access.redhat.com/errata/RHSA-2026:20609 cve-icon
https://access.redhat.com/errata/RHSA-2026:20889 cve-icon
https://access.redhat.com/errata/RHSA-2026:21017 cve-icon
https://access.redhat.com/errata/RHSA-2026:21338 cve-icon
https://access.redhat.com/errata/RHSA-2026:21655 cve-icon
https://access.redhat.com/errata/RHSA-2026:21769 cve-icon
https://access.redhat.com/errata/RHSA-2026:21772 cve-icon
https://access.redhat.com/errata/RHSA-2026:22130 cve-icon
https://access.redhat.com/errata/RHSA-2026:22141 cve-icon
https://access.redhat.com/errata/RHSA-2026:22258 cve-icon
https://access.redhat.com/errata/RHSA-2026:22260 cve-icon
https://access.redhat.com/errata/RHSA-2026:22268 cve-icon
https://access.redhat.com/errata/RHSA-2026:22309 cve-icon
https://access.redhat.com/errata/RHSA-2026:22347 cve-icon
https://access.redhat.com/errata/RHSA-2026:22415 cve-icon
https://access.redhat.com/errata/RHSA-2026:22422 cve-icon
https://access.redhat.com/errata/RHSA-2026:22465 cve-icon
https://access.redhat.com/errata/RHSA-2026:22485 cve-icon
https://access.redhat.com/errata/RHSA-2026:22709 cve-icon
https://access.redhat.com/errata/RHSA-2026:22713 cve-icon
https://access.redhat.com/errata/RHSA-2026:22840 cve-icon
https://access.redhat.com/errata/RHSA-2026:22862 cve-icon
https://access.redhat.com/errata/RHSA-2026:22958 cve-icon
https://access.redhat.com/errata/RHSA-2026:22959 cve-icon
https://access.redhat.com/errata/RHSA-2026:22960 cve-icon
https://access.redhat.com/errata/RHSA-2026:22961 cve-icon
https://access.redhat.com/errata/RHSA-2026:22962 cve-icon
https://access.redhat.com/errata/RHSA-2026:23102 cve-icon
https://access.redhat.com/errata/RHSA-2026:23103 cve-icon
https://access.redhat.com/errata/RHSA-2026:23244 cve-icon
https://access.redhat.com/errata/RHSA-2026:23345 cve-icon
https://access.redhat.com/errata/RHSA-2026:23361 cve-icon
https://access.redhat.com/errata/RHSA-2026:24337 cve-icon
https://access.redhat.com/errata/RHSA-2026:24359 cve-icon
https://access.redhat.com/errata/RHSA-2026:24470 cve-icon
https://access.redhat.com/errata/RHSA-2026:24478 cve-icon
https://access.redhat.com/errata/RHSA-2026:24716 cve-icon
https://access.redhat.com/errata/RHSA-2026:24761 cve-icon
https://access.redhat.com/errata/RHSA-2026:24762 cve-icon
https://access.redhat.com/errata/RHSA-2026:24853 cve-icon
https://access.redhat.com/errata/RHSA-2026:24977 cve-icon
https://access.redhat.com/errata/RHSA-2026:25089 cve-icon
https://access.redhat.com/errata/RHSA-2026:25127 cve-icon
https://access.redhat.com/errata/RHSA-2026:25180 cve-icon
https://access.redhat.com/errata/RHSA-2026:26447 cve-icon
https://access.redhat.com/errata/RHSA-2026:26568 cve-icon
https://access.redhat.com/errata/RHSA-2026:26571 cve-icon
https://access.redhat.com/errata/RHSA-2026:26585 cve-icon
https://access.redhat.com/errata/RHSA-2026:26636 cve-icon
https://access.redhat.com/errata/RHSA-2026:27076 cve-icon
https://access.redhat.com/errata/RHSA-2026:28038 cve-icon
https://access.redhat.com/errata/RHSA-2026:28047 cve-icon
https://access.redhat.com/errata/RHSA-2026:28074 cve-icon
https://access.redhat.com/errata/RHSA-2026:28196 cve-icon
https://access.redhat.com/errata/RHSA-2026:28198 cve-icon
https://access.redhat.com/errata/RHSA-2026:28441 cve-icon
https://access.redhat.com/errata/RHSA-2026:28886 cve-icon
https://access.redhat.com/errata/RHSA-2026:28961 cve-icon
https://access.redhat.com/errata/RHSA-2026:29035 cve-icon
https://access.redhat.com/errata/RHSA-2026:29195 cve-icon
https://access.redhat.com/errata/RHSA-2026:29455 cve-icon
https://access.redhat.com/errata/RHSA-2026:29702 cve-icon
https://access.redhat.com/errata/RHSA-2026:29703 cve-icon
https://access.redhat.com/errata/RHSA-2026:29854 cve-icon
https://access.redhat.com/errata/RHSA-2026:33722 cve-icon
https://access.redhat.com/errata/RHSA-2026:34097 cve-icon
https://access.redhat.com/errata/RHSA-2026:34192 cve-icon
https://access.redhat.com/errata/RHSA-2026:34196 cve-icon
https://access.redhat.com/errata/RHSA-2026:34197 cve-icon
https://access.redhat.com/errata/RHSA-2026:34365 cve-icon
https://access.redhat.com/errata/RHSA-2026:36319 cve-icon
https://access.redhat.com/errata/RHSA-2026:36651 cve-icon
https://access.redhat.com/errata/RHSA-2026:36796 cve-icon
https://access.redhat.com/errata/RHSA-2026:39810 cve-icon
https://access.redhat.com/errata/RHSA-2026:39894 cve-icon
https://access.redhat.com/errata/RHSA-2026:40118 cve-icon
https://access.redhat.com/errata/RHSA-2026:40945 cve-icon
https://access.redhat.com/errata/RHSA-2026:41019 cve-icon
https://access.redhat.com/errata/RHSA-2026:41928 cve-icon
https://access.redhat.com/errata/RHSA-2026:42043 cve-icon
https://access.redhat.com/errata/RHSA-2026:42047 cve-icon
https://access.redhat.com/errata/RHSA-2026:42049 cve-icon
https://access.redhat.com/errata/RHSA-2026:42050 cve-icon
https://access.redhat.com/errata/RHSA-2026:42051 cve-icon
https://access.redhat.com/errata/RHSA-2026:47712 cve-icon
https://access.redhat.com/errata/RHSA-2026:47714 cve-icon
https://access.redhat.com/errata/RHSA-2026:47716 cve-icon
https://access.redhat.com/errata/RHSA-2026:47719 cve-icon
https://access.redhat.com/errata/RHSA-2026:47721 cve-icon
https://access.redhat.com/errata/RHSA-2026:47722 cve-icon
https://access.redhat.com/errata/RHSA-2026:47910 cve-icon
https://access.redhat.com/errata/RHSA-2026:47952 cve-icon
https://access.redhat.com/errata/RHSA-2026:48036 cve-icon
https://access.redhat.com/errata/RHSA-2026:48790 cve-icon
https://access.redhat.com/errata/RHSA-2026:49509 cve-icon
https://access.redhat.com/errata/RHSA-2026:49526 cve-icon
https://access.redhat.com/errata/RHSA-2026:49600 cve-icon
https://access.redhat.com/errata/RHSA-2026:49838 cve-icon
https://access.redhat.com/errata/RHSA-2026:49944 cve-icon
https://access.redhat.com/errata/RHSA-2026:51033 cve-icon
https://access.redhat.com/errata/RHSA-2026:51288 cve-icon
https://access.redhat.com/errata/RHSA-2026:54191 cve-icon
https://access.redhat.com/errata/RHSA-2026:9385 cve-icon
https://access.redhat.com/security/cve/CVE-2026-32280 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2456339 cve-icon
https://go.dev/cl/758320 cve-icon cve-icon cve-icon
https://go.dev/issue/78282 cve-icon cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-32280 cve-icon
https://pkg.go.dev/vuln/GO-2026-4947 cve-icon cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-32280 cve-icon
History

Wed, 12 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
References

Thu, 02 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 17 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Important


Thu, 16 Apr 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Golang
Golang go
CPEs cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Vendors & Products Golang
Golang go

Thu, 09 Apr 2026 08:30:00 +0000

Type Values Removed Values Added
First Time appeared Go Standard Library
Go Standard Library crypto/x509
Vendors & Products Go Standard Library
Go Standard Library crypto/x509

Wed, 08 Apr 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}


Wed, 08 Apr 2026 01:45:00 +0000

Type Values Removed Values Added
Description During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
Title Unexpected work during chain building in crypto/x509
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-08-12T12:04:50.511Z

Reserved: 2026-03-11T16:38:46.555Z

Link: CVE-2026-32280

cve-icon Vulnrichment

Updated: 2026-08-11T12:04:53.741Z

cve-icon NVD

Status : Modified

Published: 2026-04-08T02:16:03.247

Modified: 2026-08-12T12:18:29.700

Link: CVE-2026-32280

cve-icon Redhat

Severity : Important

Publid Date: 2026-04-08T01:06:58Z

Links: CVE-2026-32280 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-09T08:28:12Z

Weaknesses