Bug 2456339 (CVE-2026-32280)
| Summary: | CVE-2026-32280 crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aazores, abarbaro, abrianik, akostadi, akoudelk, alcohan, alebedev, alinfoot, alizardo, amasferr, anjoseph, anpicker, ansmith, anthomas, aruklets, bbrownin, bdettelb, bparees, chfoley, ckandaga, cmah, crizzo, dakwon, dhanak, dkeler, dmayorov, doconnor, drosa, dschmidt, dsimansk, dtrifiro, dymurray, eaguilar, ebaron, eborisov, eglynn, ehelms, erezende, fdeutsch, ggainey, ggrzybek, gparvin, hasun, ibolton, jbalunas, jbritton, jburrell, jcantril, jchui, jeder, jfula, jhe, jjoyce, jkoehler, jlanda, jlledo, jmatsuok, jmatthew, jmontleo, jolong, jowilson, jpasqual, jprabhak, jpretori, jraez, jschluet, jtolenti, juwatts, kingland, kshier, ktsao, kverlaen, lball, lbragsta, lchilton, lgamliel, lhh, lphiri, manissin, mbocek, mburns, mdellweg, mgarciac, mhulan, mnovotny, mrunge, mwringe, nboldt, ngough, nmoumoul, nyancey, oaljalju, ometelka, oramraz, osousa, pahickey, pantinor, parichar, pcreech, peholase, pgaikwad, pjindal, psrna, ptisnovs, pvasanth, rbryant, rchan, rekumar, rfreiman, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rojacob, sakbas, sausingh, sbratsla, sdawley, sfeifer, simaishi, slucidi, smallamp, smcdonal, smullick, sseago, stcannon, stirabos, suppawar, swoodman, syedriko, tasato, teagle, thason, tmalecek, tsedmik, veshanka, vimartin, vkarehfa, vvoronko, watson-tool-maintainers, weaton, wenshen, whayutin, wtam, xdharmai, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2457792 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-04-08 02:01:42 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:10217 https://access.redhat.com/errata/RHSA-2026:10217 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:10219 https://access.redhat.com/errata/RHSA-2026:10219 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:10704 https://access.redhat.com/errata/RHSA-2026:10704 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:11507 https://access.redhat.com/errata/RHSA-2026:11507 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:11514 https://access.redhat.com/errata/RHSA-2026:11514 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:14200 https://access.redhat.com/errata/RHSA-2026:14200 This issue has been addressed in the following products: Cryostat 4 on RHEL 9 Via RHSA-2026:14391 https://access.redhat.com/errata/RHSA-2026:14391 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:15980 https://access.redhat.com/errata/RHSA-2026:15980 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:16024 https://access.redhat.com/errata/RHSA-2026:16024 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:16021 https://access.redhat.com/errata/RHSA-2026:16021 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:16875 https://access.redhat.com/errata/RHSA-2026:16875 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:17084 https://access.redhat.com/errata/RHSA-2026:17084 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:17287 https://access.redhat.com/errata/RHSA-2026:17287 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:18027 https://access.redhat.com/errata/RHSA-2026:18027 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:18032 https://access.redhat.com/errata/RHSA-2026:18032 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:19133 https://access.redhat.com/errata/RHSA-2026:19133 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:19135 https://access.redhat.com/errata/RHSA-2026:19135 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:19144 https://access.redhat.com/errata/RHSA-2026:19144 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:19350 https://access.redhat.com/errata/RHSA-2026:19350 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:19353 https://access.redhat.com/errata/RHSA-2026:19353 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:19550 https://access.redhat.com/errata/RHSA-2026:19550 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2026:19634 https://access.redhat.com/errata/RHSA-2026:19634 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:19714 https://access.redhat.com/errata/RHSA-2026:19714 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:19715 https://access.redhat.com/errata/RHSA-2026:19715 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:19719 https://access.redhat.com/errata/RHSA-2026:19719 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:19721 https://access.redhat.com/errata/RHSA-2026:19721 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:19720 https://access.redhat.com/errata/RHSA-2026:19720 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:19722 https://access.redhat.com/errata/RHSA-2026:19722 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:19750 https://access.redhat.com/errata/RHSA-2026:19750 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:19839 https://access.redhat.com/errata/RHSA-2026:19839 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:20570 https://access.redhat.com/errata/RHSA-2026:20570 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:20569 https://access.redhat.com/errata/RHSA-2026:20569 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:20571 https://access.redhat.com/errata/RHSA-2026:20571 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:20556 https://access.redhat.com/errata/RHSA-2026:20556 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:20609 https://access.redhat.com/errata/RHSA-2026:20609 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:20607 https://access.redhat.com/errata/RHSA-2026:20607 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:20608 https://access.redhat.com/errata/RHSA-2026:20608 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:22130 https://access.redhat.com/errata/RHSA-2026:22130 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:22141 https://access.redhat.com/errata/RHSA-2026:22141 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:22309 https://access.redhat.com/errata/RHSA-2026:22309 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:22709 https://access.redhat.com/errata/RHSA-2026:22709 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:22713 https://access.redhat.com/errata/RHSA-2026:22713 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2026:21655 https://access.redhat.com/errata/RHSA-2026:21655 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:23103 https://access.redhat.com/errata/RHSA-2026:23103 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:23102 https://access.redhat.com/errata/RHSA-2026:23102 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:24337 https://access.redhat.com/errata/RHSA-2026:24337 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:24470 https://access.redhat.com/errata/RHSA-2026:24470 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:24716 https://access.redhat.com/errata/RHSA-2026:24716 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.6 for RHEL 9 Red Hat Ansible Automation Platform 2.6 for RHEL 10 Via RHSA-2026:24762 https://access.redhat.com/errata/RHSA-2026:24762 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Via RHSA-2026:24761 https://access.redhat.com/errata/RHSA-2026:24761 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.19 Via RHSA-2026:23244 https://access.redhat.com/errata/RHSA-2026:23244 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:26447 https://access.redhat.com/errata/RHSA-2026:26447 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2026:25180 https://access.redhat.com/errata/RHSA-2026:25180 This issue has been addressed in the following products: Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.16 for RHEL 9 Via RHSA-2026:27076 https://access.redhat.com/errata/RHSA-2026:27076 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:28038 https://access.redhat.com/errata/RHSA-2026:28038 This issue has been addressed in the following products: Red Hat OpenStack Platform 17.1 for RHEL 9 Via RHSA-2026:28047 https://access.redhat.com/errata/RHSA-2026:28047 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:28074 https://access.redhat.com/errata/RHSA-2026:28074 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:29035 https://access.redhat.com/errata/RHSA-2026:29035 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:29195 https://access.redhat.com/errata/RHSA-2026:29195 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:29455 https://access.redhat.com/errata/RHSA-2026:29455 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:29702 https://access.redhat.com/errata/RHSA-2026:29702 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:29703 https://access.redhat.com/errata/RHSA-2026:29703 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:33722 https://access.redhat.com/errata/RHSA-2026:33722 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2026:28886 https://access.redhat.com/errata/RHSA-2026:28886 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:34192 https://access.redhat.com/errata/RHSA-2026:34192 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:34197 https://access.redhat.com/errata/RHSA-2026:34197 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:34196 https://access.redhat.com/errata/RHSA-2026:34196 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2026:28961 https://access.redhat.com/errata/RHSA-2026:28961 This issue has been addressed in the following products: RHEM 1.0 for RHEL 9 Via RHSA-2026:36796 https://access.redhat.com/errata/RHSA-2026:36796 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2026:34097 https://access.redhat.com/errata/RHSA-2026:34097 This issue has been addressed in the following products: Red Hat OpenStack Services on OpenShift 18.0 Via RHSA-2026:39810 https://access.redhat.com/errata/RHSA-2026:39810 Added rhem-1.1/flightctl affect and tracker. This stream was missing affects for this CVE since it went GA after the triage, but it's still vulnerable. This issue has been addressed in the following products: RHEM 1.1 for RHEL 10 RHEM 1.1 for RHEL 9 Via RHSA-2026:41019 https://access.redhat.com/errata/RHSA-2026:41019 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:47719 https://access.redhat.com/errata/RHSA-2026:47719 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:47722 https://access.redhat.com/errata/RHSA-2026:47722 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:47721 https://access.redhat.com/errata/RHSA-2026:47721 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:47714 https://access.redhat.com/errata/RHSA-2026:47714 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:47910 https://access.redhat.com/errata/RHSA-2026:47910 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:47716 https://access.redhat.com/errata/RHSA-2026:47716 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:47712 https://access.redhat.com/errata/RHSA-2026:47712 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:48036 https://access.redhat.com/errata/RHSA-2026:48036 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:48790 https://access.redhat.com/errata/RHSA-2026:48790 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:49509 https://access.redhat.com/errata/RHSA-2026:49509 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:49526 https://access.redhat.com/errata/RHSA-2026:49526 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:49600 https://access.redhat.com/errata/RHSA-2026:49600 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:49838 https://access.redhat.com/errata/RHSA-2026:49838 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:49944 https://access.redhat.com/errata/RHSA-2026:49944 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:51288 https://access.redhat.com/errata/RHSA-2026:51288 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:54191 https://access.redhat.com/errata/RHSA-2026:54191 |