CVE-2025-58187 - Vulnerability Details - OpenCVE

Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Golang	Crypto

No data.

No data.

References

Link	Providers
https://go.dev/cl/709854
https://go.dev/issue/75681
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
https://pkg.go.dev/vuln/GO-2025-4007

History

Thu, 30 Oct 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 30 Oct 2025 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Golang Golang crypto
Vendors & Products		Golang Golang crypto

Wed, 29 Oct 2025 22:30:00 +0000

Type	Values Removed	Values Added
Description		Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.
Title		Quadratic complexity when checking name constraints in crypto/x509
References		https://go.dev/cl/709854 https://go.dev/issue/75681 https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI https://pkg.go.dev/vuln/GO-2025-4007

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2025-10-29T22:10:12.624Z

Updated: 2025-10-30T20:34:08.900Z

Reserved: 2025-08-27T14:50:58.692Z

Link: CVE-2025-58187

Vulnrichment

Updated: 2025-10-30T20:34:03.955Z

NVD

Status : Awaiting Analysis

Published: 2025-10-29T23:16:19.643

Modified: 2025-10-30T21:15:33.983

Link: CVE-2025-58187

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-58187", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2025-08-27T14:50:58.692Z", "datePublished": "2025-10-29T22:10:12.624Z", "dateUpdated": "2025-10-30T20:34:08.900Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2025-10-29T22:10:12.624Z"}, "title": "Quadratic complexity when checking name constraints in crypto/x509", "descriptions": [{"lang": "en", "value": "Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains."}], "affected": [{"vendor": "Go standard library", "product": "crypto/x509", "collectionURL": "https://pkg.go.dev", "packageName": "crypto/x509", "versions": [{"version": "0", "lessThan": "1.24.9", "status": "affected", "versionType": "semver"}, {"version": "1.25.0", "lessThan": "1.25.3", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "parseSANExtension"}, {"name": "domainToReverseLabels"}, {"name": "CertPool.AppendCertsFromPEM"}, {"name": "Certificate.CheckCRLSignature"}, {"name": "Certificate.CheckSignature"}, {"name": "Certificate.CheckSignatureFrom"}, {"name": "Certificate.CreateCRL"}, {"name": "Certificate.Verify"}, {"name": "CertificateRequest.CheckSignature"}, {"name": "CreateCertificate"}, {"name": "CreateCertificateRequest"}, {"name": "CreateRevocationList"}, {"name": "DecryptPEMBlock"}, {"name": "EncryptPEMBlock"}, {"name": "MarshalECPrivateKey"}, {"name": "MarshalPKCS1PrivateKey"}, {"name": "MarshalPKCS1PublicKey"}, {"name": "MarshalPKCS8PrivateKey"}, {"name": "MarshalPKIXPublicKey"}, {"name": "ParseCRL"}, {"name": "ParseCertificate"}, {"name": "ParseCertificateRequest"}, {"name": "ParseCertificates"}, {"name": "ParseDERCRL"}, {"name": "ParseECPrivateKey"}, {"name": "ParsePKCS1PrivateKey"}, {"name": "ParsePKCS1PublicKey"}, {"name": "ParsePKCS8PrivateKey"}, {"name": "ParsePKIXPublicKey"}, {"name": "ParseRevocationList"}, {"name": "RevocationList.CheckSignatureFrom"}, {"name": "SetFallbackRoots"}, {"name": "SystemCertPool"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}], "references": [{"url": "https://go.dev/issue/75681"}, {"url": "https://go.dev/cl/709854"}, {"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"}, {"url": "https://pkg.go.dev/vuln/GO-2025-4007"}], "credits": [{"lang": "en", "value": "Jakub Ciolek"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-30T20:33:44.347489Z", "id": "CVE-2025-58187", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T20:34:08.900Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-58187", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-30T20:33:44.347489Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T20:34:03.955Z"}}], "cna": {"title": "Quadratic complexity when checking name constraints in crypto/x509", "credits": [{"lang": "en", "value": "Jakub Ciolek"}], "affected": [{"vendor": "Go standard library", "product": "crypto/x509", "versions": [{"status": "affected", "version": "0", "lessThan": "1.24.9", "versionType": "semver"}, {"status": "affected", "version": "1.25.0", "lessThan": "1.25.3", "versionType": "semver"}], "packageName": "crypto/x509", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "parseSANExtension"}, {"name": "domainToReverseLabels"}, {"name": "CertPool.AppendCertsFromPEM"}, {"name": "Certificate.CheckCRLSignature"}, {"name": "Certificate.CheckSignature"}, {"name": "Certificate.CheckSignatureFrom"}, {"name": "Certificate.CreateCRL"}, {"name": "Certificate.Verify"}, {"name": "CertificateRequest.CheckSignature"}, {"name": "CreateCertificate"}, {"name": "CreateCertificateRequest"}, {"name": "CreateRevocationList"}, {"name": "DecryptPEMBlock"}, {"name": "EncryptPEMBlock"}, {"name": "MarshalECPrivateKey"}, {"name": "MarshalPKCS1PrivateKey"}, {"name": "MarshalPKCS1PublicKey"}, {"name": "MarshalPKCS8PrivateKey"}, {"name": "MarshalPKIXPublicKey"}, {"name": "ParseCRL"}, {"name": "ParseCertificate"}, {"name": "ParseCertificateRequest"}, {"name": "ParseCertificates"}, {"name": "ParseDERCRL"}, {"name": "ParseECPrivateKey"}, {"name": "ParsePKCS1PrivateKey"}, {"name": "ParsePKCS1PublicKey"}, {"name": "ParsePKCS8PrivateKey"}, {"name": "ParsePKIXPublicKey"}, {"name": "ParseRevocationList"}, {"name": "RevocationList.CheckSignatureFrom"}, {"name": "SetFallbackRoots"}, {"name": "SystemCertPool"}]}], "references": [{"url": "https://go.dev/issue/75681"}, {"url": "https://go.dev/cl/709854"}, {"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"}, {"url": "https://pkg.go.dev/vuln/GO-2025-4007"}], "descriptions": [{"lang": "en", "value": "Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2025-10-29T22:10:12.624Z"}}}, "cveMetadata": {"cveId": "CVE-2025-58187", "state": "PUBLISHED", "dateUpdated": "2025-10-30T20:34:08.900Z", "dateReserved": "2025-08-27T14:50:58.692Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2025-10-29T22:10:12.624Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}