Improper resource allocation In stdlib
Description
Excessive resource consumption when printing error string for host certificate validation in crypto/x509 Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 1.24.11 | ||
 debian 11 | - | ||
debian 14 | 1.25.6-1 | ||
debian 12 | - | ||
debian 13 | - | ||
 rpm rhel8 | 0:3.4.1-7.el8_10 | ||
rpm rhel8.4 | 0:1.15.14-3.module+el8.4.0+22765+91da4d3f | ||
rpm rhel9.4 | 0:9.2.10-25.el9_4 | ||
rpm rhel9.4 | 0:0.135.0-3.el9_4 | ||
rpm rhel10 | - | - |
1-10 of 106
10
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3.