{"id":"CVE-2025-58187","sourceIdentifier":"security@golang.org","published":"2025-10-29T23:16:19.643","lastModified":"2026-10-08T10:10:00.227","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains."},{"lang":"es","value":"Debido al diseño del algoritmo de verificación de restricciones de nombre, el tiempo de procesamiento de algunas entradas escala de forma no lineal con respecto al tamaño del certificado. Esto afecta a programas que validan cadenas de certificados arbitrarias."}],"affected":[{"source":"security@golang.org","affectedData":[{"vendor":"Go standard library","product":"crypto/x509","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"crypto/x509","programRoutines":[{"name":"parseSANExtension"},{"name":"domainToReverseLabels"},{"name":"CertPool.AppendCertsFromPEM"},{"name":"Certificate.CheckCRLSignature"},{"name":"Certificate.CheckSignature"},{"name":"Certificate.CheckSignatureFrom"},{"name":"Certificate.CreateCRL"},{"name":"Certificate.Verify"},{"name":"CertificateRequest.CheckSignature"},{"name":"CreateCertificate"},{"name":"CreateCertificateRequest"},{"name":"CreateRevocationList"},{"name":"DecryptPEMBlock"},{"name":"EncryptPEMBlock"},{"name":"MarshalECPrivateKey"},{"name":"MarshalPKCS1PrivateKey"},{"name":"MarshalPKCS1PublicKey"},{"name":"MarshalPKCS8PrivateKey"},{"name":"MarshalPKIXPublicKey"},{"name":"ParseCRL"},{"name":"ParseCertificate"},{"name":"ParseCertificateRequest"},{"name":"ParseCertificates"},{"name":"ParseDERCRL"},{"name":"ParseECPrivateKey"},{"name":"ParsePKCS1PrivateKey"},{"name":"ParsePKCS1PublicKey"},{"name":"ParsePKCS8PrivateKey"},{"name":"ParsePKIXPublicKey"},{"name":"ParseRevocationList"},{"name":"RevocationList.CheckSignatureFrom"},{"name":"SetFallbackRoots"},{"name":"SystemCertPool"}],"versions":[{"version":"0","lessThan":"1.24.9","versionType":"semver","status":"affected"},{"version":"1.25.0","lessThan":"1.25.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-11-03T19:51:43.036632Z","id":"CVE-2025-58187","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","versionEndExcluding":"1.24.9","matchCriteriaId":"C89AAA9E-5381-4C85-836A-04FD377BA155"},{"vulnerable":true,"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","versionStartIncluding":"1.25.0","versionEndExcluding":"1.25.3","matchCriteriaId":"37360D5C-FBAB-40DE-8397-F84D46242AF4"}]}]}],"references":[{"url":"https://go.dev/cl/709854","source":"security@golang.org","tags":["Patch"]},{"url":"https://go.dev/issue/75681","source":"security@golang.org","tags":["Issue Tracking"]},{"url":"https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","source":"security@golang.org","tags":["Mailing List","Release Notes"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4007","source":"security@golang.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/10/08/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Release Notes"]}]}