The vulnerability in Go's crypto/x509 package involves inefficient repeated string splitting in the VerifyHostname method when processing multiple DNS SAN entries. Specifically, the method calls matchHostnames in a loop over all SAN entries, and each call executes strings.Split(host, ".") on the same hostname, resulting in quadratic time complexity relative to the number of SAN entries and hostname label count. This inefficiency impacts the performance of hostname verification even for untrusted certificates, potentially causing excessive CPU usage during TLS certificate validation.

The impact is primarily performance-related, causing increased CPU usage and verification latency when validating certificates with large DNS SAN lists. This could degrade service responsiveness or resource utilization in applications relying on Go's crypto/x509 for TLS hostname verification. There is no indication of direct security compromise such as code execution or data leakage. No known exploits exist in the wild.

Patch status is not yet confirmed — no official fix or remediation guidance is currently available from the vendor. Users should monitor the Go project advisories for updates. Until a fix is released, consider limiting the size of DNS SAN lists in certificates or implementing application-level controls to mitigate potential performance impacts.