CVE-2025-58187

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/709854	Patch
https://go.dev/issue/75681	Issue Tracking
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI	Mailing List Release Notes
https://pkg.go.dev/vuln/GO-2025-4007	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/10/08/1	Mailing List Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

History

08 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Debido al diseño del algoritmo de verificación de restricciones de nombre, el tiempo de procesamiento de algunas entradas escala de forma no lineal con respecto al tamaño del certificado. Esto afecta a programas que validan cadenas de certificados arbitrarias.

Information

Published : 2025-10-29 23:16

Updated : 2026-10-08 10:10

NVD link : CVE-2025-58187

Mitre link : CVE-2025-58187

CVE.ORG link : CVE-2025-58187

JSON object : View

Products Affected

golang

go

CWE

CWE-407

Inefficient Algorithmic Complexity

{"id": "CVE-2025-58187", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58187", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-03T19:51:43.036632Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "Go standard library", "product": "crypto/x509", "versions": [{"status": "affected", "version": "0", "lessThan": "1.24.9", "versionType": "semver"}, {"status": "affected", "version": "1.25.0", "lessThan": "1.25.3", "versionType": "semver"}], "packageName": "crypto/x509", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "parseSANExtension"}, {"name": "domainToReverseLabels"}, {"name": "CertPool.AppendCertsFromPEM"}, {"name": "Certificate.CheckCRLSignature"}, {"name": "Certificate.CheckSignature"}, {"name": "Certificate.CheckSignatureFrom"}, {"name": "Certificate.CreateCRL"}, {"name": "Certificate.Verify"}, {"name": "CertificateRequest.CheckSignature"}, {"name": "CreateCertificate"}, {"name": "CreateCertificateRequest"}, {"name": "CreateRevocationList"}, {"name": "DecryptPEMBlock"}, {"name": "EncryptPEMBlock"}, {"name": "MarshalECPrivateKey"}, {"name": "MarshalPKCS1PrivateKey"}, {"name": "MarshalPKCS1PublicKey"}, {"name": "MarshalPKCS8PrivateKey"}, {"name": "MarshalPKIXPublicKey"}, {"name": "ParseCRL"}, {"name": "ParseCertificate"}, {"name": "ParseCertificateRequest"}, {"name": "ParseCertificates"}, {"name": "ParseDERCRL"}, {"name": "ParseECPrivateKey"}, {"name": "ParsePKCS1PrivateKey"}, {"name": "ParsePKCS1PublicKey"}, {"name": "ParsePKCS8PrivateKey"}, {"name": "ParsePKIXPublicKey"}, {"name": "ParseRevocationList"}, {"name": "RevocationList.CheckSignatureFrom"}, {"name": "SetFallbackRoots"}, {"name": "SystemCertPool"}]}]}], "published": "2025-10-29T23:16:19.643", "references": [{"url": "https://go.dev/cl/709854", "tags": ["Patch"], "source": "security@golang.org"}, {"url": "https://go.dev/issue/75681", "tags": ["Issue Tracking"], "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI", "tags": ["Mailing List", "Release Notes"], "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2025-4007", "tags": ["Vendor Advisory"], "source": "security@golang.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/08/1", "tags": ["Mailing List", "Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains."}, {"lang": "es", "value": "Debido al dise\u00f1o del algoritmo de verificaci\u00f3n de restricciones de nombre, el tiempo de procesamiento de algunas entradas escala de forma no lineal con respecto al tama\u00f1o del certificado. Esto afecta a programas que validan cadenas de certificados arbitrarias."}], "lastModified": "2026-10-08T10:10:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C89AAA9E-5381-4C85-836A-04FD377BA155", "versionEndExcluding": "1.24.9"}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37360D5C-FBAB-40DE-8397-F84D46242AF4", "versionEndExcluding": "1.25.3", "versionStartIncluding": "1.25.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@golang.org"}