A vulnerability in the Go crypto/x509 library allows unauthenticated attackers to trigger excessive resource consumption through specially crafted certificates.

This is an uncontrolled resource consumption flaw (CWE-400) occurring within the HostnameError.Error() function, where repeated string concatenation leads to quadratic runtime performance when processing malicious certificates provided by an unauthenticated attacker.

The vulnerability poses a significant denial of service risk to applications utilizing the Go crypto/x509 library for certificate validation. With a CVSS score of 7.5, the flaw is considered High severity, as an attacker can force a target application to exhaust CPU and memory resources by submitting a single malicious certificate, potentially leading to service outages and system instability.

Immediate Action: Update the Go environment to version 1.24.11 or 1.25.5 to incorporate the necessary patches for the crypto/x509 library.

Proactive Monitoring: Monitor server CPU and memory usage metrics for sudden, unexplained spikes in resource consumption during TLS handshake processes.

Compensating Controls: Implement strict input validation and limits on the number of hostnames permitted in incoming certificates at the network gateway or load balancer level if immediate patching is not feasible.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability represents a high risk for any service relying on Go for secure communication. Given the ease with which an attacker can trigger the quadratic runtime complexity, organizations must prioritize updating their Go toolchains to the specified patched versions. Failure to remediate may leave infrastructure susceptible to targeted denial of service attacks against critical authentication and encryption endpoints.