CVE-2026-32281
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.
Risk Assessment
An attacker could cause system overload during certificate validation, leading to service unavailability.
Recommendation
Apply security updates provided by the software vendor (e.g., Go, OpenSSL) to mitigate this vulnerability.
Other vulnerabilities in Certificate validation
See all- CVE-2025-61727Medium
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
- CVE-2025-58188High
Validating certificate chains which contain DSA public keys can cause programs to panic, due to an interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.
Original NVD description (English source)
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS