CVE-2025-61727: Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN .example.com.
Other sources
Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
— Microsoft
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61727?
CVE-2025-61727 is classified as a medium severity vulnerability.
How do I fix CVE-2025-61727?
To fix CVE-2025-61727, update to Golang versions 1.25.6 or newer to address the wildcard SAN usage issue.
What versions of Golang are affected by CVE-2025-61727?
Golang versions 1.25.5 and 1.24.11 are affected by CVE-2025-61727.
What are the potential risks associated with CVE-2025-61727?
The potential risks include the misuse of wildcard SANs, which could lead to misconfigured certificates and security breaches.
Is CVE-2025-61727 specific to certain software or services?
Yes, CVE-2025-61727 specifically affects applications using Golang versions that do not properly restrict wildcard SANs.