CVE-2025-61727: Go standard library crypto/x509 · Improper Certificate Validation
Affects Go standard library crypto/x509Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 20% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 3 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Gogithub.com/golang/go/src/crypto/x509pkg:golang/github.com/golang/go/src/crypto/x509Other threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate this vulnerability, European organizations should: 1) Monitor for official patches or updates from the Go project and apply them promptly once available, upgrading to a version beyond 1.25.0 where the issue is fixed. 2) Until patches are available, implement additional certificate validation layers outside of the standard crypto/x509 package to enforce subdomain exclusions explicitly, such as custom validation logic that checks SANs against exclusion lists. 3) Limit the use of wildcard certificates where possible, especially in environments where subdomain exclusions are critical for security. 4) Employ network-level protections such as TLS interception proxies with enhanced certificate validation capabilities to detect anomalous certificates. 5) Conduct thorough audits of existing certificates and certificate chains to identify any wildcard SANs that could be abused under this vulnerability. 6) Educate development and security teams about the risks of relying solely on default certificate validation and encourage defense-in-depth strategies. 7) For critical services, consider using certificate pinning or alternative cryptographic libraries with verified validation behavior as a temporary workaround. 8) Enhance monitoring and alerting for suspicious TLS certificate usage or unexpected subdomain access patterns to detect potential exploitation attempts early.
Description
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.