Description
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, -.-) to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname-s label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
CVSS 6.5EPSS 0.5910000000000001%Risk 0.68
View source- Published
- 2026-06-02 23:16:35
- Affected versions
- unknown
- Type
- Core software
- Last modified
- 2026-08-11 13:18:11
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H