VulnSocial

CVE-2026-27145Patch

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-606

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-06-03); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-06-03: 1Mentions · 2026-06-06: 1Mentions · 2026-06-10: 1Patch / Workaround · 2026-06-06: 1Patch / Workaround · 2026-06-10: 1Technical Details · 2026-06-03: 1Technical Details · 2026-06-06: 1Technical Details · 2026-06-10: 106-0306-0606-10
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-031
Disclosure1
2026-06-061
Patch1
2026-06-101
Patch1
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Patch

    Go 1.26.4, 1.25.11 fix 3 CVEs https://www.openwall.com/lists/oss-security/2026/06/03/2 CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping CVE-2026-27145: crypto/x509: split candidate hostname only once

    Post summary

    The post announces that Go 1.26.4 and 1.25.11 address three CVEs, providing technical details about the vulnerabilities but no PoC, exploit, or active usage reports.

    01040443
    4.7K followersView on X
  • ThreatCluster@threatcluster
    Patch

    SUSE released new Go1.25.11 and Go1.26.4 packages fixing CVE-2026-27145, CVE-2026-42504 and CVE-2026-42507 in crypto/x509, mime and net/textproto, rated as moderate severity, according to Linuxsecurity. https://threatcluster.io/cluster/suse-releases-security-updates-for-go125-and-go126-addressin-32626cd0

    Post summary

    SUSE released updates for Go 1.25.11 and 1.26.4 to remediate three CVEs affecting crypto/x509, mime, and net/textproto modules, with no active exploitation or PoC reported.

    0000049
    318 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, "."… https://www.cve.org/CVERecord?id=CVE-2026-27145

    Post summary

    The passage discloses CVE‑2026‑27145, outlining how VerifyHostname’s loop over DNS SAN entries triggers a strings.Split error, but offers no details on PoC, exploit, patch, or active exploitation.

    00000185
    57.6K followersView on X

Explore more

Back to dashboard