CVE-2026-32280
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
During chain building, the amount of work is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
Risk Assessment
An attacker can overload the server by providing a large number of intermediate certificates, causing denial of service.
Recommendation
Update Go to a patched version and limit the number of intermediate certificates accepted during verification.
Other vulnerabilities in Go crypto/x509
See all- CVE-2026-111943Medium
The Go standard library (crypto/x509) added a denylist of known intermediate certificates no longer considered trustworthy. This defends against cases where system trust stores may not be updated without further action.
- CVE-2025-61729High
Within HostnameError.Error(), there is no limit to the number of hosts printed when constructing an error string, and the string is built by repeated concatenation, leading to quadratic runtime. A certificate provided by a malicious actor can result in excessive resource consumption.
Original NVD description (English source)
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS