EUVD-2026-34038Published

Inefficient candidate hostname parsing in crypto/x509

Explicit identifiers and source references

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-27145 · Microsoft / collected KEV context

EUVD-2026-34038

GHSA-4279-q6mj-392r

GO-2026-5037

BIT-golang-2026-27145

cve-program · CVE-2026-27145

euvd · EUVD-2026-34038

nvd · CVE-2026-27145

osv · GO-2026-5037

Related operational evidence

Explicit CVE identifiers

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN l… · Advisory content revised · 9 Nov 2026
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN l… · Advisory content revised · 7 Nov 2026
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN l… · Advisory content revised · 1 Nov 2026
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN l… · Advisory content revised · 30 Oct 2026