Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.

🗓️ 04 Sep 2025 03:43:28Reported by MicrosoftType

mscve

mscve🔗 msrc.microsoft.com👁 1 Views

Go 1.18.x before 1.18.1 panics Certificate.Verify on macOS with malformed certs, enabling remote TLS panic.

Reporter	Title	Published	Views	Family All 55
ALT Linux	Security fix for the ALT Linux 10 package golang version 1.17.9-alt1	13 Apr 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package golang version 1.17.9-alt1.p10	18 Apr 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Golang Go and MinIO may affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift (CVE-2022-24842,CVE-2021-38561,CVE-2021-43565,CVE-2022-28327,CVE-2022-24675,CVE-2022-27536)	29 Jun 202222:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go	13 Oct 202222:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to assorted vulnerabilities in Grafana	19 Jul 202421:46	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in the Golang language affect IBM Event Streams (CVE-2022-28327, CVE-2022-24675, CVE-2022-27536)	12 Jul 202214:59	–	ibm
ATTACKERKB	CVE-2022-27536	20 Apr 202210:15	–	attackerkb
AlpineLinux	CVE-2022-27536	20 Apr 202200:00	–	alpinelinux
CNNVD	Google Go 信任管理问题漏洞	20 Apr 202200:00	–	cnnvd
CVE	CVE-2022-27536	20 Apr 202200:00	–	cve

04 Sep 2025 03:43Current

7High risk

Vulners AI Score7

CVSS 25

CVSS 3.17.5

EPSS0.00564

go vulnerability certificate verify malformed certificates remote panic macos