CVE-2026-32281 Details
Description
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
A denial-of-service vulnerability has been identified in the Go programming language's standard library, specifically within the crypto/x509 package. This issue arises during the validation of certificate chains that utilize policies, particularly when the certificates contain a large number of policy mappings. The vulnerability can lead to significant slowdowns in the verification process, causing applications to become unresponsive. This problem only occurs with trusted certificate chains issued by a root CA in the VerifyOptions.Roots CertPool or the system certificate pool.
Users can upgrade to Go versions 1.26.2 or 1.25.9, both of which include the necessary fix. Instructions for downloading these versions are available on the Go website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://go.dev/cl/758061 | [email protected] | Patch |
| https://go.dev/issue/78281 | [email protected] | Issue Tracking |
| https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU | [email protected] | Issue TrackingRelease Notes |
| https://pkg.go.dev/vuln/GO-2026-4946 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| golang go | < 1.25.9 >= 1.26.0, < 1.26.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 25, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Apr 13, 2026 | CVE Modified | CISA-ADP |
| Apr 8, 2026 | New CVE Received | [email protected] |