Descrição
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, -.-) to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname-s label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
CVSS 6.5EPSS 0.5910000000000001%Risco 0.68
Ver fonte- Publicação
- 2026-06-02 23:16:35
- Versões afetadas
- unknown
- Tipo
- Core software
- Última alteração
- 2026-08-11 13:18:11
- Vetor
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H