Red Hat EUVD-2026-20010

This vulnerability resides in Go's crypto/x509 package, the standard library component responsible for X.509 certificate parsing and validation. The issue stems from inefficient algorithmic handling of policy mapping extensions (RFC 5280 section 4.2.1.5), which allow certificate authorities to map policies between domains in certification chains. When a certificate contains an abnormally large number of policy mappings, the validation process exhibits superlinear time complexity, causing CPU exhaustion. Policy mappings are rarely used in practice, making this a niche attack surface. The vulnerable code path is only triggered during validation of chains that anchor to a trusted root in VerifyOptions.Roots or the system certificate pool, meaning the attacker must possess a legitimately-issued certificate from a trusted CA to exploit this flaw-not a typical attacker-controlled scenario. CPE cpe:2.3:a:go_standard_library:crypto/x509 identifies the affected component across all Go-dependent applications using the standard library for TLS/certificate operations.