Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-27145 Details

Description

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: redhat-SADPCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://access.redhat.com/errata/RHSA-2026:23262 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:23264 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:29980 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:29981 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:33574 redhat-SADP

see all 100 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-606Unchecked Input for Loop Conditionredhat-SADP

Affected Products

No affected product data is available for this CVE.

Change History

52 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-27145
NVD Published Date:
Jun 2, 2026
NVD Last Modified:
Sep 18, 2026
Source:
[email protected]
CVE-2026-27145 Details - Not Deferred