CVE-2026-32280: Unexpected work during chain building in crypto/x509
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32280?
The severity of CVE-2026-32280 is classified as a denial of service vulnerability.
How do I fix CVE-2026-32280?
To fix CVE-2026-32280, upgrade to Go versions 1.25.9 or above, or ensure you are using 1.26.2 or higher.
What is the impact of CVE-2026-32280?
The impact of CVE-2026-32280 can lead to denial of service due to excessive resource consumption when processing a large number of intermediate certificates.
Which software versions are affected by CVE-2026-32280?
CVE-2026-32280 affects Go versions prior to 1.25.9 and between 1.26.0 and 1.26.2.
Is CVE-2026-32280 specific to any libraries?
Yes, CVE-2026-32280 specifically affects the Go crypto/x509 and crypto/tls libraries.