HomeDefault status
unaffected
Any version before 1.24.9
affected
1.25.0 (semver) before 1.25.3
affected
Description
Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.
Problem types
CWE-407: Inefficient Algorithmic Complexity
Product status
Any version before 1.24.9
1.25.0 (semver) before 1.25.3
Credits
Jakub Ciolek
References
www.openwall.com/lists/oss-security/2025/10/08/1
groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
