crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

🗓️ 20 May 2026 16:45:20Reported by RedHatType

redhat🔗 access.redhat.com👁 29 Views

A denial of service in Go's crypto/x509 from large policy mappings in certificate chains.

Reporter	Title	Published	Views	Family All 1683
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities addressed with IBM Business Automation Workflow cumulative fixes June 2026	29 Jun 202610:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	19 Jun 202608:05	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in Golang version shipped with IBM Guardium Cryptography Manager (GCM)	27 Aug 202613:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	22 Jul 202617:41	–	ibm
Tenable Nessus	Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-1593)	30 Apr 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : credentials-fetcher (ALAS2023-2026-1598)	30 Apr 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : golist (ALAS2023-2026-1599)	30 Apr 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nerdctl (ALAS2023-2026-1605)	30 Apr 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-1606)	30 Apr 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : rclone (ALAS2023-2026-1607)	30 Apr 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	10.0	aarch64	opentelemetry-collector	0.144.0-2.el10_0	opentelemetry-collector-0.144.0-2.el10_0.aarch64.rpm
Red Hat Enterprise Linux	10.0	ppc64le	opentelemetry-collector	0.144.0-2.el10_0	opentelemetry-collector-0.144.0-2.el10_0.ppc64le.rpm
Red Hat Enterprise Linux	10.0	s390x	opentelemetry-collector	0.144.0-2.el10_0	opentelemetry-collector-0.144.0-2.el10_0.s390x.rpm
Red Hat Enterprise Linux	10.0	x86_64	opentelemetry-collector	0.144.0-2.el10_0	opentelemetry-collector-0.144.0-2.el10_0.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-32281
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/758061
go	www.go.dev/issue/78281
groups	www.groups.google.com/g/golang-announce/c/0uYbvbPZRWU
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-32281
pkg	www.pkg.go.dev/vuln/GO-2026-4946
cve	www.cve.org/CVERecord

04 Sep 2026 08:44Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

EPSS0.00355

SSVC

Go crypto/x509 certificate validation policy mappings denial of service resource exhaustion