{"id":"CVE-2025-58187","revision":"60ba4cf49fed4421a6c6a8d8e8c135aa","records":[{"revision":"60ba4cf49fed4421a6c6a8d8e8c135aa","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-58187","aliases":[],"title":"Quadratic complexity when checking name constraints in crypto/x509","description":"Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.","state":0,"publishedAt":"2025-10-29T22:10:12.624+00:00","modifiedAt":"2025-11-20T22:23:47.179+00:00","affected":[{"ecosystem":"https://pkg.go.dev","name":"crypto/x509","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Go standard library\",\n                    \"product\": \"crypto/x509\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"crypto/x509\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.24.9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"1.25.0\",\n                            \"lessThan\": \"1.25.3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"parseSANExtension\"\n                        },\n                        {\n                            \"name\": \"domainToReverseLabels\"\n                        },\n                        {\n                            \"name\": \"CertPool.AppendCertsFromPEM\"\n                        },\n                        {\n                            \"name\": \"Certificate.CheckCRLSignature\"\n                        },\n                        {\n                            \"name\": \"Certificate.CheckSignature\"\n                        },\n                        {\n                            \"name\": \"Certificate.CheckSignatureFrom\"\n                        },\n                        {\n                            \"name\": \"Certificate.CreateCRL\"\n                        },\n                        {\n                            \"name\": \"Certificate.Verify\"\n                        },\n                        {\n                            \"name\": \"CertificateRequest.CheckSignature\"\n                        },\n                        {\n                            \"name\": \"CreateCertificate\"\n                        },\n                        {\n                            \"name\": \"CreateCertificateRequest\"\n                        },\n                        {\n                            \"name\": \"CreateRevocationList\"\n                        },\n                        {\n                            \"name\": \"DecryptPEMBlock\"\n                        },\n                        {\n                            \"name\": \"EncryptPEMBlock\"\n                        },\n                        {\n                            \"name\": \"MarshalECPrivateKey\"\n                        },\n                        {\n                            \"name\": \"MarshalPKCS1PrivateKey\"\n                        },\n                        {\n                            \"name\": \"MarshalPKCS1PublicKey\"\n                        },\n                        {\n                            \"name\": \"MarshalPKCS8PrivateKey\"\n                        },\n                        {\n                            \"name\": \"MarshalPKIXPublicKey\"\n                        },\n                        {\n                            \"name\": \"ParseCRL\"\n                        },\n                        {\n                            \"name\": \"ParseCertificate\"\n                        },\n                        {\n                            \"name\": \"ParseCertificateRequest\"\n                        },\n                        {\n                            \"name\": \"ParseCertificates\"\n                        },\n                        {\n                            \"name\": \"ParseDERCRL\"\n                        },\n                        {\n                            \"name\": \"ParseECPrivateKey\"\n                        },\n                        {\n                            \"name\": \"ParsePKCS1PrivateKey\"\n                        },\n                        {\n                            \"name\": \"ParsePKCS1PublicKey\"\n                        },\n                        {\n                            \"name\": \"ParsePKCS8PrivateKey\"\n                        },\n                        {\n                            \"name\": \"ParsePKIXPublicKey\"\n                        },\n                        {\n                            \"name\": \"ParseRevocationList\"\n                        },\n                        {\n                            \"name\": \"RevocationList.CheckSignatureFrom\"\n                        },\n                        {\n                            \"name\": \"SetFallbackRoots\"\n                        },\n                        {\n                            \"name\": \"SystemCertPool\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://go.dev/issue/75681","https://go.dev/cl/709854","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4007"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-58187","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-58187","identifiers":["CVE-2025-58187"]},"retained":false,"historicalAffected":[]}],"coverage":[]}