{"id":"CVE-2026-32280","summary":"Unexpected work during chain building in crypto/x509","details":"During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.","aliases":["BIT-golang-2026-32280","GO-2026-4947"],"modified":"2026-07-29T03:30:35.596658713Z","published":"2026-04-08T01:06:58.595Z","related":["ALSA-2026:10704","ALSA-2026:11507","ALSA-2026:11514","ALSA-2026:14200","ALSA-2026:16875","ALSA-2026:19133","ALSA-2026:19135","ALSA-2026:19350","ALSA-2026:19353","ALSA-2026:22141","ALSA-2026:23102","ALSA-2026:24470","ALSA-2026:26447","ALSA-2026:28074","ALSA-2026:29035","ALSA-2026:29195","ALSA-2026:29455","ALSA-2026:29702","ALSA-2026:29703","ALSA-2026:33722","CGA-crmm-287q-6v8j","SUSE-SU-2026:1320-1","SUSE-SU-2026:1321-1","SUSE-SU-2026:1580-1","SUSE-SU-2026:1581-1","SUSE-SU-2026:21355-1","SUSE-SU-2026:21356-1","SUSE-SU-2026:22572-1","SUSE-SU-2026:22638-1","openSUSE-SU-2026:10514-1","openSUSE-SU-2026:10525-1","openSUSE-SU-2026:10664-1","openSUSE-SU-2026:20570-1","openSUSE-SU-2026:20571-1","openSUSE-SU-2026:21254-1","openSUSE-SU-2026:21319-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32280.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"1.25.9"},{"introduced":"1.26.0-0"},{"fixed":"1.26.2"}]}],"cna_assigner":"Go"},"references":[{"type":"WEB","url":"https://go.dev/cl/758320"},{"type":"WEB","url":"https://go.dev/issue/78282"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"},{"type":"WEB","url":"https://pkg.go.dev"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2026-4947"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10217"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10219"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10704"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11507"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11514"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11688"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13545"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13791"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13826"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13829"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14020"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14162"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14200"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14391"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:15980"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16021"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16024"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16101"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16476"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16477"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16505"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16508"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16532"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16534"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16535"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16537"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16542"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16874"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16875"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17084"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17287"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18027"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18032"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19133"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19135"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19144"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19350"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19353"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19375"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19450"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19550"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19634"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19714"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19715"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19719"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19720"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19721"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19722"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19750"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19839"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20556"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20569"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20570"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20571"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20607"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20608"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20609"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20889"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21338"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21655"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21769"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22130"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22141"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22258"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22260"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22268"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22309"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22347"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22415"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22422"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22465"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22485"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22709"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22713"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22840"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22862"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22958"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22959"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22960"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22961"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22962"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23102"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23103"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23244"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23345"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23361"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24337"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24359"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24470"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24478"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24716"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24761"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24853"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25089"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25127"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25180"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26447"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26568"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26571"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26585"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26636"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27076"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28038"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28047"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28074"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28196"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28198"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28441"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28886"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28961"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29035"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29195"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29455"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29702"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29703"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29854"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33722"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34097"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34192"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34196"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34197"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34365"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36319"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36651"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36796"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:39810"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:39894"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40118"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40945"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41019"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41928"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42043"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42047"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42049"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42050"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42051"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9385"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-32280"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32280.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456339"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/golang/go","events":[{"introduced":"0"},{"fixed":"7076e01d9d450bae9f25be76f45d58cc52e2aad2"},{"introduced":"d90b98e65320778f3b1f99a6951ab20f04d218b3"},{"fixed":"9c8bf0e72a6fb3b415b591b124b59fbb7cf92252"}],"database_specific":{"cpe":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.25.9"},{"introduced":"1.26.0"},{"fixed":"1.26.2"}],"source":"CPE_RANGE"}}],"versions":["go1.26.1","go1.25.8","go1.25.7","go1.26.0","go1.25.6","go1.25.5","go1.25.4","go1.25.3","go1.25.2","go1.25.1","go1.25.0","go1.25rc3","go1.25rc2","go1.25rc1","go1.19beta1","go1.18beta2","go1.18beta1","go1.17beta1","go1.16beta1","go1.15beta1","go1.14beta1","go1.13beta1","go1.12beta2","go1.12beta1","go1.11beta3","go1.11beta2","go1.11beta1","go1.10rc2","go1.10rc1","go1.10beta2","go1.10beta1","go1.9beta2","go1.9beta1","go1.8beta2","go1.8beta1","go1.7rc4","go1.7rc3","go1.7rc2","go1.7rc1","go1.7beta2","go1.7beta1","go1.6beta2","go1.6beta1","go1.5beta3","go1.5beta2","go1.5beta1","go1.4beta1","go1.3beta2","go1.3beta1","weekly.2012-03-27","weekly","weekly.2012-03-22","weekly.2012-03-13","weekly.2012-03-04","weekly.2012-02-22","weekly.2012-02-14","weekly.2012-02-07","weekly.2012-01-27","weekly.2012-01-20","weekly.2012-01-15","weekly.2011-12-22","weekly.2011-12-14","weekly.2011-12-06","weekly.2011-12-02","weekly.2011-12-01","weekly.2011-11-18","weekly.2011-11-09","weekly.2011-11-08","weekly.2011-11-02","weekly.2011-11-01","weekly.2011-10-26","weekly.2011-10-25","weekly.2011-10-18","weekly.2011-10-06","weekly.2011-09-21","weekly.2011-09-16","weekly.2011-08-17","weekly.2011-09-07","weekly.2011-09-01","weekly.2011-08-10","weekly.2011-07-07","weekly.2011-07-29","weekly.2011-07-19","weekly.2011-06-09","weekly.2011-06-23","weekly.2011-06-16","weekly.2011-06-02","weekly.2011-05-22","weekly.2011-04-27","weekly.2011-04-13","weekly.2011-04-04","weekly.2011-03-28","weekly.2011-03-15","weekly.2011-03-07.1","release.r56","weekly.2011-03-07","weekly.2011-02-24","weekly.2011-02-15","weekly.2011-02-01.1","weekly.2011-02-01","weekly.2011-01-20","weekly.2011-01-19","weekly.2011-01-12","weekly.2011-01-06","weekly.2010-12-22","weekly.2010-12-15.1","weekly.2010-12-15","weekly.2010-12-08","weekly.2010-12-02","weekly.2010-11-23","weekly.2010-11-10","weekly.2010-11-02","weekly.2010-10-27","weekly.2010-10-20","weekly.2010-10-13.1","weekly.2010-10-13","weekly.2010-09-29","weekly.2010-09-22","weekly.2010-09-15","weekly.2010-09-06","weekly.2010-08-25","weekly.2010-08-11","weekly.2010-08-04","weekly.2010-07-29","weekly.2010-07-14","weekly.2010-07-01","weekly.2010-06-21","weekly.2010-06-09","weekly.2010-05-27","weekly.2010-05-04","weekly.2010-04-27","weekly.2010-04-13","weekly.2010-03-30","weekly.2010-03-22","weekly.2010-03-15","weekly.2010-03-04","weekly.2010-02-23","weekly.2010-02-17","weekly.2010-02-04","weekly.2010-01-27","weekly.2010-01-13","weekly.2010-01-05","weekly.2009-12-22","weekly.2009-12-09","weekly.2009-12-07","weekly.2009-11-17","weekly.2009-11-12","weekly.2009-11-10.1","weekly.2009-11-10","weekly.2009-11-06"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32280.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}