Loading story…
A denial-of-service vulnerability tracked as CVE-2026-32280 was disclosed in Go's standard library, affecting crypto/x509 and crypto/tls during X.509 certificate verification. The flaw stems from excessive certificate chain-building work in Verify when an attacker supplies a large number of candidate intermediate certificates, causing uncontrolled CPU and resource consumption and potentially making applications unavailable.
The issue affects systems that use Go to process untrusted TLS certificates or X.509 chains, particularly network-facing services that accept attacker-controlled certificate inputs. Red Hat rated the vulnerability Important with a CVSS v3.1 score of 7.5, mapped it to CWE-770, and published fixes across multiple products, including Red Hat Enterprise Linux 10 golang and several Ansible Automation Platform, Cryostat, and HawtIO components.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat listed Cryostat 4 on RHEL 9, component cryostat/cryostat-storage-rhel9, as fixed for CVE-2026-32280 in advisory RHSA-2026:14391.
Red Hat listed Red Hat Enterprise Linux 10 golang as fixed for CVE-2026-32280 in advisory RHSA-2026:10217.
Red Hat published its CVE record for CVE-2026-32280, describing an Important denial-of-service flaw in Go's crypto/x509 and crypto/tls packages caused by excessive intermediate certificate processing during chain building.
A Go issue was opened to track excessive certificate chain-building work in crypto/x509 Verify when many candidate parent certificates are supplied, associated with CVE-2026-32280.
Red Hat last modified its CVE-2026-32280 entry, updating the vendor record for the Go denial-of-service vulnerability.
Red Hat listed HawtIO 4.4.0 component hawtio-operator-container as fixed for CVE-2026-32280 in advisory RHSA-2026:25089.
Red Hat listed multiple Red Hat Ansible Automation Platform 2.5 and 2.6 components on RHEL 8, 9, and 10 as fixed for CVE-2026-32280 in advisories RHSA-2026:24761 and RHSA-2026:24762.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A denial-of-service vulnerability tracked as **CVE-2026-32281** was disclosed in Go’s `crypto/x509` package after maintainers found certificate policy validation can degrade to quadratic work when processing chains with very large `PolicyMappings`. The flaw affects verification of otherwise trusted certificate chains anchored in `VerifyOptions.Roots` or the system certificate pool, allowing excessive CPU and resource consumption during chain validation. Exploitation requires a specially crafted chain tied to a compromised trusted root, but Red Hat still rated the issue **Moderate** while noting higher severity scores were assigned by other scoring authorities. Red Hat said fixes were issued across a wide range of products, including multiple **Red Hat Enterprise Linux** versions and update streams, **Satellite**, **Cryostat**, **OpenStack**, **Ansible Automation Platform**, and **RHEM/flightctl**, with additional affected products added as availability changed after initial triage. Red Hat also stated there is **no acceptable mitigation** short of applying vendor updates, making patch deployment the primary response for organizations running Go-based services or platforms that rely on `crypto/x509` certificate chain validation.
Sep 1, 2026
An **Important** vulnerability tracked as `CVE-2026-33810` affects Go's `crypto/x509` package and can allow a certificate validation bypass during trusted certificate chain verification. The flaw stems from excluded DNS constraints not being correctly applied to wildcard DNS Subject Alternative Names when the SAN's case differs from the constraint, creating a path for a malicious certificate to be accepted when it should be rejected. Red Hat assigned the issue a **CVSS v3 score of 8.8** and warned that affected products could accept malicious certificates from otherwise trusted chains, weakening the certificate trust model. Red Hat said multiple affected products and components have been fixed through security errata, while the CVE record formally tracks the issue as `CVE-2026-33810`.
Aug 20, 2026
Go disclosed **CVE-2026-32283**, an Important denial-of-service flaw in `crypto/tls` that can deadlock TLS 1.3 connections when a peer sends multiple post-handshake key update messages in a single record, leading to uncontrolled resource consumption. Go also disclosed **CVE-2026-27144** in `cmd/compile`, where a no-op interface conversion could bypass overlap checks for memory moves, creating conditions for unsafe overlapping copies and possible memory corruption or unexpected behavior at runtime. Red Hat subsequently shipped fixes for these Go flaws across multiple RHEL 8, 9, and 10 channels and dependent packages including **golang**, **rhc**, **ipp-usb**, **gvisor-tap-vsock**, and **Cryostat 4**, often alongside other Go vulnerabilities in `crypto/x509` and `internal/syscall/unix`. Advisories rated the updates **Important**, with `CVE-2026-32283` scored **CVSS 7.5** by Red Hat, and updated package builds were released for major architectures including `x86_64`, `aarch64`, `ppc64le`, and `s390x` across standard, EUS, AUS, SAP, and Extended Life Cycle offerings.
Aug 20, 2026