CVE Intelligence
Skip to main content
MEDIUMpublic exploit

CVE-2026-27145

CVE-2026-27145 — Inefficient candidate hostname parsing in crypto/x509

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

Published Updated Sources: cvelistV5, Go

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Exploit code

public exploit, none observed

EPSS

1%

chance of exploitation in 30 days

Affects

go standard library

131 products listed

CVSS base

6.5

MEDIUM

CISA SSVC assessment

Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.

CISA

Exploitation

None

none · proof-of-concept · active

Automatable

No

can an attacker script all four kill-chain steps

Technical impact

Partial

partial · total control of the vulnerable component

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Products (131)

crypto x509red hat ansible automation platform 2 5 for rhel 8red hat ansible automation platform 2 5 for rhel 9red hat ansible automation platform 2 6 for rhel 10red hat ansible automation platform 2 6 for rhel 9red hat ansible automation platform 2 7 for rhel 10red hat ansible automation platform 2 7 for rhel 9red hat enterprise linux 10red hat enterprise linux 10 0 extended update supportred hat enterprise linux 7 extended lifecycle supportred hat enterprise linux 8red hat enterprise linux 9red hat enterprise linux 9 2 update services for sap solutionsred hat enterprise linux 9 4 update services for sap solutionsred hat enterprise linux 9 6 extended update supportred hat openshift container platform 4 18red hat openstack platform 16 2red hat satellite 6 16 for rhel 8red hat satellite 6 16 for rhel 9red hat satellite 6 17 for rhel 9red hat satellite 6 18 for rhel 9red hat satellite 6 19 for rhel 9rhem 1 1 for rhel 10rhem 1 1 for rhel 9rhem 1 2 for rhel 10rhem 1 2 for rhel 9streams for apache kafka 3 2 1cert manager support for red hat openshift release 1 19cluster observability operator 1 5 0compliance operator 1external secrets operator for red hat openshift 1 1multicluster engine for kubernetes 2 1multicluster engine for kubernetes 2 11multicluster engine for kubernetes 2 17multicluster engine for kubernetes 2 6multicluster engine for kubernetes 2 8multicluster engine for kubernetes 2 9multicluster global hub 1 4 5multicluster global hub 1 6 5multicluster global hub 1 7 0multicluster global hub 1 8 0openshift api for data protection 1 5openshift developer tools and services 1 6 3red hat advanced cluster management for kubernetes 2 11red hat advanced cluster management for kubernetes 2 13red hat advanced cluster management for kubernetes 2 14red hat advanced cluster management for kubernetes 2 15red hat advanced cluster management for kubernetes 2 16red hat advanced cluster management for kubernetes 2 17red hat ansible automation platform 2 7red hat developer hub 1 9red hat hardened imagesred hat lightspeed formerly insights for runtimes 1 0red hat openshift ai 2 25red hat openshift builds 1 7 3red hat openshift builds 1 8 1red hat openshift container platform 4 17red hat openshift container platform 4 21red hat openshift distributed tracing 3 10 2red hat openshift service mesh 3 0red hat openshift service mesh 3 1red hat openshift service mesh 3 2red hat openshift service mesh 3 3red hat openshift service mesh 3 4red hat trusted artifact signer 1 4red hat web terminal 1 11red hat web terminal 1 12red hat web terminal 1 13red hat web terminal 1 14red hat web terminal 1 15red hat web terminal 1 16assisted installer for red hat openshift container platform 2confidential compute attestationcryostat 4custom metric autoscaler operator for red hat openshiftdeployment validation operatorexternaldns operatorfence agents remediation operatorfile integrity operatorgatekeeper 3logging subsystem for red hat openshiftlogical volume manager storagemachine deletion remediation operatormigration toolkit for applications 8migration toolkit for containersmirror registry for red hat openshift 2multiarch tuning operatormulticluster engine for kubernetesnetwork observability operatornode healthcheck operatoropenshift developer tools and servicesopenshift lightspeedopenshift pipelinesopenshift serverlessopenshift service mesh 2openshift service mesh 3power monitoring for red hat openshiftred hat 3scale api management platform 2red hat advanced cluster management for kubernetes 2red hat advanced cluster security 4red hat ansible automation platform 2red hat ceph storage 5red hat ceph storage 6red hat ceph storage 7red hat ceph storage 8red hat ceph storage 9red hat connectivity link 1red hat edge manager 1red hat enterprise linux 7red hat enterprise linux ai rhel ai 3red hat openshift ai rhoaired hat openshift cluster manager clired hat openshift container platform 4red hat openshift data foundation 4red hat openshift dev spacesred hat openshift dev workspaces operatorred hat openshift distributed tracing 3red hat openshift for windows containersred hat openshift gitopsred hat openshift on awsred hat openshift virtualization 4red hat openstack platform 17 1red hat openstack platform 18 0red hat quay 3red hat satellite 6red hat service interconnect 2security profiles operatorservice telemetry framework 1 5streams for apache kafka 2zero trust workload identity managerzero trust workload identity manager tech preview

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

ScoreVersionSeverityExpl.ImpactSource
6.5CVSS 3.1MEDIUM——cvelistV5

Weakness & attack patterns

  • CWE-606

Public exploit

Capability, not use: code existing is a different claim from anyone running it.

Indexed by

poc in github

References

25 on the record

Elsewhere on this site

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.