CLEANSTART-2026-HQ88036 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

🗓️ 30 Apr 2026 01:00:58Reported by GoogleType

osv🔗 osv.dev👁 24 Views

Terragrunt-fips has vulnerabilities; chain building does not limit work from intermediate certificates.

Reporter	Title	Published	Views	Family All 114206
OSV	CGA-2499-26M6-3GMJ	17 Jul 202600:26	–	osv
OSV	CGA-2499-3GHJ-WMW3	22 Nov 202513:02	–	osv
OSV	CGA-249C-V59Q-MFJQ	10 Mar 202611:54	–	osv
OSV	CGA-249G-QHJ2-72F5	8 Dec 202510:11	–	osv
OSV	CGA-249H-CJ33-M6Q3	22 Nov 202501:25	–	osv
OSV	CGA-249J-32X3-4QF3	10 Mar 202611:13	–	osv
OSV	CGA-249M-2M44-X3GF	10 Mar 202611:35	–	osv
OSV	CGA-249R-WG4Q-7R6R	6 Dec 202522:06	–	osv
OSV	CGA-249V-3X3P-9C7G	10 Apr 202622:24	–	osv
OSV	CGA-249W-PJQX-2P86	5 Dec 202520:32	–	osv

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HQ88036.json
osv	www.osv.dev/vulnerability/CVE-2025-47913
osv	www.osv.dev/vulnerability/CVE-2025-47914
osv	www.osv.dev/vulnerability/CVE-2025-58181
osv	www.osv.dev/vulnerability/CVE-2025-61727
osv	www.osv.dev/vulnerability/CVE-2025-61729
osv	www.osv.dev/vulnerability/CVE-2026-1229
osv	www.osv.dev/vulnerability/CVE-2026-24051
osv	www.osv.dev/vulnerability/CVE-2026-25679
osv	www.osv.dev/vulnerability/CVE-2026-26958

30 Apr 2026 05:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.19.8

EPSS0.01557

terragrunt-fips chain building intermediate certificates verify options security vulnerabilities