PkgSeer

Vulnerability GO-2025-4155

Unknown

11 months ago

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

<1.24.11, >=1.25.0 <1.25.5

Summary

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

Details

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

HTTP/1 server crash due to MaxBytesReader header race in net/http

<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6859

Distrust compromised intermediate certificates in crypto/x509

<1.26.10, >=1.27.0-0 <1.27.3 GO-2026-6809

Reset context tracking on consecutive template expressions in html/template

<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599

Recognize yield as regexp preceder keyword in html/template

<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600

HTTP/2 server memory exhaustion due to Trailer headers in net/http

<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603

View all vulnerabilities for these packages

Impacted packages

stdlib

Timeline

Published

11 months ago

Last Modified

6 hours ago