Is CVE-2026-27145 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27145 being exploited in the wild.

How severe is CVE-2026-27145?

Informational severity, with a CVSS score of 0, published 2 June 2026.

Which products and versions are affected?

stdlib (Go) SEMVER:introduced=0,fixed=1.25.11,introduced=1.26.0-0,fixed=1.26.4.

Is there a fix for CVE-2026-27145?

Yes. stdlib (Go): upgrade to 1.26.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27145 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27145?

Check whether you run stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27145: Google Go CPU denial of service in crypto/x509 VerifyHostname

CVE-2026-27145 · Severity: info · CVSS 0 · Published 2026-06-02

A performance issue was identified in the Go programming language's security library used for validating digital certificates. An attacker could provide a specially crafted certificate or hostname that causes the system to spend an excessive amount of processing power during the validation process. This could lead to a denial-of-service (DoS) condition where the application becomes slow or unresponsive while trying to verify untrusted connections.

Technologies: stdlib (Go). Vendors: Go.

Quick answers

Is CVE-2026-27145 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27145 being exploited in the wild.
How severe is CVE-2026-27145?: Informational severity, with a CVSS score of 0, published 2 June 2026.
Which products and versions are affected?: stdlib (Go) SEMVER:introduced=0,fixed=1.25.11,introduced=1.26.0-0,fixed=1.26.4.
Is there a fix for CVE-2026-27145?: Yes. stdlib (Go): upgrade to 1.26.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27145 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27145?: Check whether you run stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

stdlib (Go): upgrade to 1.26.4 or later
```
go get stdlib@v1.26.4
```

Technical details

The (*x509.Certificate).VerifyHostname function in Go's crypto/x509 package previously implemented hostname matching by calling matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused the strings.Split(host, ".") operation to execute repeatedly on the same input hostname, leading to quadratic resource consumption (O(n*m) where n is the number of SANs and m is the label count of the hostname). Because hostname validation occurs before certificate chain building in x509.Verify, this overhead is incurred even for untrusted or malicious certificates. Attackers can exploit this to cause high CPU usage on clients or servers performing certificate verification. The issue is fixed in Go 1.25.11 and 1.26.4.

Affected products

Google Go before 1.25.11, 1.26.0 before 1.26.4

Identifiers

CVE-2026-27145
GO-2026-5037

Timeline

2026-05-27: disclosed: Issue reported to Go project by Jakub Ciolek
2026-06-02: advisory: NVD and Go vulnerability report published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.