{"id":"GO-2025-4175","revision":"1e04d46549174ab2afe79215c952b663","records":[{"revision":"1e04d46549174ab2afe79215c952b663","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-4175","aliases":["BIT-golang-2025-61727","CVE-2025-61727"],"title":"Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509","description":"An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.","state":0,"publishedAt":"2025-12-02T20:55:55+00:00","modifiedAt":"2026-05-15T10:59:24.0630404+00:00","affected":[{"ecosystem":"Go","name":"stdlib","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.24.11"},{"kind":"introduced","version":"1.25.0"},{"kind":"fixed","version":"1.25.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://go.dev/cl/723900","https://go.dev/issue/76442","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-4175","license":"OSV · upstream source license applies","key":"osv:GO-2025-4175","identifiers":["GO-2025-4175","BIT-golang-2025-61727","CVE-2025-61727"]},"retained":false,"historicalAffected":[]}],"coverage":[]}