Popis
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, -.-) to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname-s label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
CVSS 6.5EPSS 0.5910000000000001%Riziko 0.68
Zobraziť zdroj- Zverejnené
- 2026-06-02 23:16:35
- Dotknuté verzie
- unknown
- Typ
- Core software
- Posledná úprava
- 2026-08-11 13:18:11
- Vektor
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H