UNKNOWN Go

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

GO-2025-4155 · BIT-golang-2025-61729 · CVE-2025-61729

Published · Modified

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Description

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

Ready to move

Start Securing

Free, no credit card | First findings in minutes