{"id":"CVE-2025-61727","sourceIdentifier":"security@golang.org","published":"2025-12-03T20:16:25.607","lastModified":"2026-10-18T17:10:00.110","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com."},{"lang":"es","value":"Una restricción de subdominio excluido en una cadena de certificados no restringe el uso de SANs comodín en el certificado hoja. Por ejemplo, una restricción que excluye el subdominio test.example.com no impide que un certificado hoja reclame el SAN *.example.com."}],"affected":[{"source":"security@golang.org","affectedData":[{"vendor":"Go standard library","product":"crypto/x509","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"crypto/x509","programRoutines":[{"name":"Certificate.Verify"}],"versions":[{"version":"0","lessThan":"1.24.11","versionType":"semver","status":"affected"},{"version":"1.25.0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-03T22:06:13.958433Z","id":"CVE-2025-61727","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-295"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","versionEndExcluding":"1.24.11","matchCriteriaId":"F2E6FD2A-A487-4099-B91D-2429F286AC6D"},{"vulnerable":true,"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","versionStartIncluding":"1.25","versionEndExcluding":"1.25.5","matchCriteriaId":"EC1866EE-ABDC-4F74-9657-70A1241D49BD"}]}]}],"references":[{"url":"https://go.dev/cl/723900","source":"security@golang.org","tags":["Patch"]},{"url":"https://go.dev/issue/76442","source":"security@golang.org","tags":["Issue Tracking"]},{"url":"https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","source":"security@golang.org","tags":["Mailing List","Release Notes"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4175","source":"security@golang.org","tags":["Vendor Advisory"]}]}