CVE-2025-61727

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/723900	Patch
https://go.dev/issue/76442	Issue Tracking
https://groups.google.com/g/golang-announce/c/8FJoBkPddm4	Mailing List Release Notes
https://pkg.go.dev/vuln/GO-2025-4175	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

History

18 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Una restricción de subdominio excluido en una cadena de certificados no restringe el uso de SANs comodín en el certificado hoja. Por ejemplo, una restricción que excluye el subdominio test.example.com no impide que un certificado hoja reclame el SAN *.example.com.

Information

Published : 2025-12-03 20:16

Updated : 2026-10-18 17:10

NVD link : CVE-2025-61727

Mitre link : CVE-2025-61727

CVE.ORG link : CVE-2025-61727

JSON object : View

Products Affected

golang

go

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2025-61727", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61727", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T22:06:13.958433Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "Go standard library", "product": "crypto/x509", "versions": [{"status": "affected", "version": "0", "lessThan": "1.24.11", "versionType": "semver"}, {"status": "affected", "version": "1.25.0", "lessThan": "1.25.5", "versionType": "semver"}], "packageName": "crypto/x509", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "Certificate.Verify"}]}]}], "published": "2025-12-03T20:16:25.607", "references": [{"url": "https://go.dev/cl/723900", "tags": ["Patch"], "source": "security@golang.org"}, {"url": "https://go.dev/issue/76442", "tags": ["Issue Tracking"], "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4", "tags": ["Mailing List", "Release Notes"], "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2025-4175", "tags": ["Vendor Advisory"], "source": "security@golang.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com."}, {"lang": "es", "value": "Una restricci\u00f3n de subdominio excluido en una cadena de certificados no restringe el uso de SANs comod\u00edn en el certificado hoja. Por ejemplo, una restricci\u00f3n que excluye el subdominio test.example.com no impide que un certificado hoja reclame el SAN *.example.com."}], "lastModified": "2026-10-18T17:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2E6FD2A-A487-4099-B91D-2429F286AC6D", "versionEndExcluding": "1.24.11"}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC1866EE-ABDC-4F74-9657-70A1241D49BD", "versionEndExcluding": "1.25.5", "versionStartIncluding": "1.25"}], "operator": "OR"}]}], "sourceIdentifier": "security@golang.org"}