During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
| Vendor | Product | Versions |
|---|---|---|
| go standard library | crypto/x509 | 0, 1.26.0-0, 1.25.8, 1.26.1 |
Updated affected versions to include 1.25.8 and 1.26.1, changed severity to HIGH, and noted that no exploit exists.
Initial creation
