Skip to main content

Crypto X509 CVE-2026-32280

| EUVDEUVD-2026-20008 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-04-08 Go
Denial Of Service Crypto X509 Go Standard Library
7.5
CVSS 3.1 · Vendor: Go
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Submit TLS connection with oversized Intermediates certificate chain
  2. Exploit
    Trigger unbounded work in chain building validation
  3. Impact
    Exhaust CPU resources and cause denial of service

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Remote unauthenticated attacker sends TLS connection or crafted certificate chain with large number of intermediate certificates in VerifyOptions.Intermediates to Go applications using crypto/x509 or crypto/tls. No user interaction required. Affects default configurations of affected Go versions.
Impact

The CVSS 7.5 score (High severity) reflects the ease of exploitation-network accessible, low complexity, no authentication or user interaction required-combined with complete availability impact. However, real-world risk signals present a nuanced picture. The EPSS score of 0.01% (bottom percentile) indicates virtually no observed exploitation activity in the wild, and no public exploit code exists. CISA SSVC assessment confirms no active exploitation while noting the attack is automatable, meaning tooling could be developed to exploit vulnerable Go services at scale. The technical impact is partial (availability only), limiting blast radius compared to confidentiality or integrity compromises. The primary risk exposure is to internet-facing Go applications handling TLS connections or certificate verification from untrusted sources-web servers, API gateways, proxies. Organizations running Go services in production should prioritize patching, but the absence of exploitation activity and low EPSS suggests this is not being actively weaponized. The discrepancy between high CVSS and low EPSS likely reflects that most Go deployments use reverse proxies or load balancers that terminate TLS externally, reducing the attack surface.
Exploit ScenarioDerived

An attacker identifies a public-facing Go web service accepting HTTPS connections. During the TLS handshake, the attacker's client presents a valid certificate chain but includes hundreds or thousands of crafted intermediate certificates in the certificate message. The Go server's crypto/tls package invokes crypto/x509 chain building, which attempts to evaluate all possible paths through the excessive intermediates without hitting resource limits. CPU utilization spikes on the server as the chain builder performs exponential work, causing response delays for legitimate requests. By repeating this attack across multiple concurrent connections, the attacker exhausts server CPU resources, rendering the service unavailable. Since the CVSS vector indicates no authentication requirement and low attack complexity, the attacker can automate this using scripted TLS clients, achieving denial of service without sophisticated tooling.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 08, 2026

Denial of service in Go's crypto/x509 chain builder allows remote attackers to exhaust server resources by submitting a large number of intermediate certificates during TLS handshake or direct certificate verification. Affects crypto/x509 versions prior to 1.25.9 and 1.26.0-1.26.1. No public exploit identified at time of analysis, though SSVC assessment indicates the attack is automatable. EPSS exploitation probability is minimal (0.01%), suggesting low observed attacker interest despite the network-accessible attack surface and lack of authentication requirements.

RemediationAI

Upgrade to Go version 1.25.9 or later for the 1.25.x series, or Go version 1.26.2 or later for the 1.26.x series, as documented in the vendor security announcement at https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU. The fix implementation is available in code review https://go.dev/cl/758320 and addresses the resource allocation issue by imposing proper computational limits during certificate chain building. After upgrading the Go toolchain, recompile and redeploy all affected applications to incorporate the patched crypto/x509 library, as Go binaries statically link the standard library. For environments where immediate patching is infeasible, implement network-level rate limiting or TLS termination at a hardened reverse proxy to reduce exposure, though these workarounds do not eliminate risk for direct crypto/x509 API usage. Validate the fix using the vulnerability database entry at https://pkg.go.dev/vuln/GO-2026-4947 and verify deployed Go version using 'go version' on production binaries.

Affected VersionsENISA

crypto/x509 0 <1.25.9
crypto/x509 1.26.0-0 <1.26.2

Affected Packages

go stdlib fix: 1.25.9, 1.26.2
euvd crypto_x509 fix: 1.25.9, 1.26.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Go standard library's crypto/x509 package implements X.509 certificate chain building and validation, a critical component for TLS/SSL certificate verification. When validating a certificate chain, the library attempts to build a trust path from the presented certificate to a trusted root by evaluating intermediate certificates. The vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) stems from insufficient computational limits during this chain-building process when processing certificates provided in VerifyOptions.Intermediates. An attacker can exploit this by presenting an excessive number of intermediate certificates, forcing the chain builder into exponential or polynomial time complexity operations without adequate resource bounds. This affects both direct API consumers calling crypto/x509 verification functions and indirect users relying on crypto/tls for HTTPS/TLS connections, as TLS handshakes invoke certificate chain validation internally.

Know when Crypto X509 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Go) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (Go).

CVSS VectorVendor: Go

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Apr 08, 2026 - 02:30 nvd
Patch available
CVE Published
Apr 08, 2026 - 01:06 nvd
HIGH 7.5

DescriptionCVE.org

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

Executive ViewAI

Why It Matters

CVE-2026-32280 is a denial-of-service vulnerability in Go's crypto/x509 certificate chain validation that allows unauthenticated remote attackers to exhaust server resources during TLS handshakes. Organizations running Go applications with affected crypto/x509 versions face potential service disruption if clients submit crafted certificate chains, though current exploitation activity remains minimal. Immediate patching of Go to version 1.25.9 or 1.26.2+ is required to eliminate this network-accessible attack vector.

Business Impact: High
Compensating Controls

Apply vendor patch (Go 1.25.9, 1.26.2 or later). If patch deployment is delayed: implement connection rate limiting on TLS handshake endpoints; configure certificate chain depth limits in load balancers or reverse proxies to reject certificates with excessive intermediate certificate counts; monitor for sudden increases in failed certificate validation events.

Threat Intelligence Overview

EPSS Score
0.0%
Top 100% exploitable
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Crypto X509

View all
CVE-2026-33810 HIGH
8.2 Apr 08

Certificate validation bypass in Go's crypto/x509 library (versions 1.26.0-1.26.1) allows remote attackers to circumvent
CVE-2026-32281 HIGH
7.5 Apr 08

Algorithmic complexity denial of service in Go's crypto/x509 library allows remote attackers to cause resource exhaustio
CVE-2026-27145 MEDIUM
6.5 Jun 02

Quadratic-complexity denial-of-service in Go's crypto/x509 package allows a network-positioned attacker presenting a cer

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/355983 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1320/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1321/ REF https://access.redhat.com/errata/RHSA-2026:10217 REF https://access.redhat.com/errata/RHSA-2026:10219 REF https://access.redhat.com/errata/RHSA-2026:10704 REF https://access.redhat.com/errata/RHSA-2026:11507 REF https://access.redhat.com/errata/RHSA-2026:11514 REF https://access.redhat.com/errata/RHSA-2026:11688 REF https://access.redhat.com/errata/RHSA-2026:13545 REF https://access.redhat.com/errata/RHSA-2026:13791 REF https://access.redhat.com/errata/RHSA-2026:13826 REF https://access.redhat.com/errata/RHSA-2026:13829 REF https://access.redhat.com/errata/RHSA-2026:14020 REF https://access.redhat.com/errata/RHSA-2026:14162 REF https://access.redhat.com/errata/RHSA-2026:14200 REF https://access.redhat.com/errata/RHSA-2026:14391 REF https://access.redhat.com/errata/RHSA-2026:15980 REF https://access.redhat.com/errata/RHSA-2026:16021 REF https://access.redhat.com/errata/RHSA-2026:16024 REF https://access.redhat.com/errata/RHSA-2026:16101 REF https://access.redhat.com/errata/RHSA-2026:16476 REF https://access.redhat.com/errata/RHSA-2026:16477 REF https://access.redhat.com/errata/RHSA-2026:16505 REF https://access.redhat.com/errata/RHSA-2026:16508 REF https://access.redhat.com/errata/RHSA-2026:16532 REF https://access.redhat.com/errata/RHSA-2026:16534 REF https://access.redhat.com/errata/RHSA-2026:16535 REF https://access.redhat.com/errata/RHSA-2026:16537 REF https://access.redhat.com/errata/RHSA-2026:16542 REF https://access.redhat.com/errata/RHSA-2026:16874 REF https://access.redhat.com/errata/RHSA-2026:16875 REF https://access.redhat.com/errata/RHSA-2026:17084 REF https://access.redhat.com/errata/RHSA-2026:17287 REF https://access.redhat.com/errata/RHSA-2026:18027 REF https://access.redhat.com/errata/RHSA-2026:18032 REF https://access.redhat.com/errata/RHSA-2026:19133 REF https://access.redhat.com/errata/RHSA-2026:19135 REF https://access.redhat.com/errata/RHSA-2026:19144 REF https://access.redhat.com/errata/RHSA-2026:19350 REF https://access.redhat.com/errata/RHSA-2026:19353 REF https://access.redhat.com/errata/RHSA-2026:19375 REF https://access.redhat.com/errata/RHSA-2026:19450 REF https://access.redhat.com/errata/RHSA-2026:19550 REF https://access.redhat.com/errata/RHSA-2026:19634 REF https://access.redhat.com/errata/RHSA-2026:19714 REF https://access.redhat.com/errata/RHSA-2026:19715 REF https://access.redhat.com/errata/RHSA-2026:19719 REF https://access.redhat.com/errata/RHSA-2026:19720 REF https://access.redhat.com/errata/RHSA-2026:19721 REF https://access.redhat.com/errata/RHSA-2026:19722 REF https://access.redhat.com/errata/RHSA-2026:19750 REF https://access.redhat.com/errata/RHSA-2026:19839 REF https://access.redhat.com/errata/RHSA-2026:20556 REF https://access.redhat.com/errata/RHSA-2026:20569 REF https://access.redhat.com/errata/RHSA-2026:20570 REF https://access.redhat.com/errata/RHSA-2026:20571 REF https://access.redhat.com/errata/RHSA-2026:20607 REF https://access.redhat.com/errata/RHSA-2026:20608 REF https://access.redhat.com/errata/RHSA-2026:20609 REF https://access.redhat.com/errata/RHSA-2026:20889 REF https://access.redhat.com/errata/RHSA-2026:21017 REF https://access.redhat.com/errata/RHSA-2026:21338 REF https://access.redhat.com/errata/RHSA-2026:21655 REF https://access.redhat.com/errata/RHSA-2026:21769 REF https://access.redhat.com/errata/RHSA-2026:21772 REF https://access.redhat.com/errata/RHSA-2026:22130 REF https://access.redhat.com/errata/RHSA-2026:22141 REF https://access.redhat.com/errata/RHSA-2026:22258 REF https://access.redhat.com/errata/RHSA-2026:22260 REF https://access.redhat.com/errata/RHSA-2026:22268 REF https://access.redhat.com/errata/RHSA-2026:22309 REF https://access.redhat.com/errata/RHSA-2026:22347 REF https://access.redhat.com/errata/RHSA-2026:22415 REF https://access.redhat.com/errata/RHSA-2026:22422 REF https://access.redhat.com/errata/RHSA-2026:22465 REF https://access.redhat.com/errata/RHSA-2026:22485 REF https://access.redhat.com/errata/RHSA-2026:22709 REF https://access.redhat.com/errata/RHSA-2026:22713 REF https://access.redhat.com/errata/RHSA-2026:22840 REF https://access.redhat.com/errata/RHSA-2026:22862 REF https://access.redhat.com/errata/RHSA-2026:22958 REF https://access.redhat.com/errata/RHSA-2026:22959 REF https://access.redhat.com/errata/RHSA-2026:22960 REF https://access.redhat.com/errata/RHSA-2026:22961 REF https://access.redhat.com/errata/RHSA-2026:22962 REF https://access.redhat.com/errata/RHSA-2026:23102 REF https://access.redhat.com/errata/RHSA-2026:23103 REF https://access.redhat.com/errata/RHSA-2026:23244 REF https://access.redhat.com/errata/RHSA-2026:23345 REF https://access.redhat.com/errata/RHSA-2026:23361 REF https://access.redhat.com/errata/RHSA-2026:24337 REF https://access.redhat.com/errata/RHSA-2026:24359 REF https://access.redhat.com/errata/RHSA-2026:24470 REF https://access.redhat.com/errata/RHSA-2026:24478 REF https://access.redhat.com/errata/RHSA-2026:24716 REF https://access.redhat.com/errata/RHSA-2026:24761 REF https://access.redhat.com/errata/RHSA-2026:24762 REF https://access.redhat.com/errata/RHSA-2026:24853 REF https://access.redhat.com/errata/RHSA-2026:24977 REF https://access.redhat.com/errata/RHSA-2026:25089 REF https://access.redhat.com/errata/RHSA-2026:25127 REF https://access.redhat.com/errata/RHSA-2026:25180 REF https://access.redhat.com/errata/RHSA-2026:25248 REF https://access.redhat.com/errata/RHSA-2026:25250 REF https://access.redhat.com/errata/RHSA-2026:25251 REF https://access.redhat.com/errata/RHSA-2026:25252 REF https://access.redhat.com/errata/RHSA-2026:25253 REF https://access.redhat.com/errata/RHSA-2026:26447 REF https://access.redhat.com/errata/RHSA-2026:26568 REF https://access.redhat.com/errata/RHSA-2026:26571 REF https://access.redhat.com/errata/RHSA-2026:26585 REF https://access.redhat.com/errata/RHSA-2026:26636 REF https://access.redhat.com/errata/RHSA-2026:27076 REF https://access.redhat.com/errata/RHSA-2026:28038 REF https://access.redhat.com/errata/RHSA-2026:28047 REF https://access.redhat.com/errata/RHSA-2026:28074 REF https://access.redhat.com/errata/RHSA-2026:28196 REF https://access.redhat.com/errata/RHSA-2026:28198 REF https://access.redhat.com/errata/RHSA-2026:28441 REF https://access.redhat.com/errata/RHSA-2026:28886 REF https://access.redhat.com/errata/RHSA-2026:28961 REF https://access.redhat.com/errata/RHSA-2026:29035 REF https://access.redhat.com/errata/RHSA-2026:29195 REF https://access.redhat.com/errata/RHSA-2026:29455 REF https://access.redhat.com/errata/RHSA-2026:29702 REF https://access.redhat.com/errata/RHSA-2026:29703 REF https://access.redhat.com/errata/RHSA-2026:29854 REF https://access.redhat.com/errata/RHSA-2026:33722 REF https://access.redhat.com/errata/RHSA-2026:34097 REF https://access.redhat.com/errata/RHSA-2026:34192 REF https://access.redhat.com/errata/RHSA-2026:34196 REF https://access.redhat.com/errata/RHSA-2026:34197 REF https://access.redhat.com/errata/RHSA-2026:34365 REF https://access.redhat.com/errata/RHSA-2026:36319 REF https://access.redhat.com/errata/RHSA-2026:36625 REF https://access.redhat.com/errata/RHSA-2026:36651 REF https://access.redhat.com/errata/RHSA-2026:36796 REF https://access.redhat.com/errata/RHSA-2026:39810 REF https://access.redhat.com/errata/RHSA-2026:39894 REF https://access.redhat.com/errata/RHSA-2026:40118 REF https://access.redhat.com/errata/RHSA-2026:40945 REF https://access.redhat.com/errata/RHSA-2026:41019 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:42043 REF https://access.redhat.com/errata/RHSA-2026:42047 REF https://access.redhat.com/errata/RHSA-2026:42049 REF https://access.redhat.com/errata/RHSA-2026:42050 REF https://access.redhat.com/errata/RHSA-2026:42051 REF https://access.redhat.com/errata/RHSA-2026:47712 REF https://access.redhat.com/errata/RHSA-2026:47714 REF https://access.redhat.com/errata/RHSA-2026:47716 REF https://access.redhat.com/errata/RHSA-2026:47719 REF https://access.redhat.com/errata/RHSA-2026:47721 REF https://access.redhat.com/errata/RHSA-2026:47722 REF https://access.redhat.com/errata/RHSA-2026:47910 REF https://access.redhat.com/errata/RHSA-2026:47952 REF https://access.redhat.com/errata/RHSA-2026:48036 REF https://access.redhat.com/errata/RHSA-2026:48790 REF https://access.redhat.com/errata/RHSA-2026:49509 REF https://access.redhat.com/errata/RHSA-2026:49526 REF https://access.redhat.com/errata/RHSA-2026:49600 REF https://access.redhat.com/errata/RHSA-2026:49838 REF https://access.redhat.com/errata/RHSA-2026:49944 REF https://access.redhat.com/errata/RHSA-2026:51033 REF https://access.redhat.com/errata/RHSA-2026:51288 REF https://access.redhat.com/errata/RHSA-2026:54191 REF https://access.redhat.com/errata/RHSA-2026:54603 REF https://access.redhat.com/errata/RHSA-2026:54757 REF https://access.redhat.com/errata/RHSA-2026:56785 REF https://access.redhat.com/errata/RHSA-2026:56789 REF https://access.redhat.com/errata/RHSA-2026:56852 REF https://access.redhat.com/errata/RHSA-2026:56855 REF https://access.redhat.com/errata/RHSA-2026:56910 REF https://access.redhat.com/errata/RHSA-2026:56912 REF https://access.redhat.com/errata/RHSA-2026:56913 REF https://access.redhat.com/errata/RHSA-2026:57409 REF https://access.redhat.com/errata/RHSA-2026:57482 REF https://access.redhat.com/errata/RHSA-2026:57488 REF https://access.redhat.com/errata/RHSA-2026:59830 REF https://access.redhat.com/errata/RHSA-2026:59833 REF https://access.redhat.com/errata/RHSA-2026:59834 REF https://access.redhat.com/errata/RHSA-2026:60018 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:61685 REF https://access.redhat.com/errata/RHSA-2026:61906 REF https://access.redhat.com/errata/RHSA-2026:61907 REF https://access.redhat.com/errata/RHSA-2026:65534 REF https://access.redhat.com/errata/RHSA-2026:65838 REF https://access.redhat.com/errata/RHSA-2026:65886 REF https://access.redhat.com/errata/RHSA-2026:66401 REF https://access.redhat.com/errata/RHSA-2026:67319 REF https://access.redhat.com/errata/RHSA-2026:68504 REF https://access.redhat.com/errata/RHSA-2026:9385 REF https://access.redhat.com/security/cve/CVE-2026-32280 REF https://bugzilla.redhat.com/show_bug.cgi?id=2456339 REF https://go.dev/cl/758320 REF https://go.dev/issue/78282 REF https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU REF https://pkg.go.dev/vuln/GO-2026-4947 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy