The vulnerability in Go's crypto/x509 package (CVE-2026-27145) is due to inefficient algorithmic complexity in the VerifyHostname method. Specifically, the method called matchHostnames in a loop over all DNS SAN entries, repeatedly executing strings.Split on the same hostname. This results in quadratic scaling of processing time relative to the number of SAN entries and hostname label count. Because hostname verification occurs before certificate chain building, this overhead affects all certificates, including untrusted ones, potentially enabling denial of service via resource exhaustion. The issue is tracked with a CVSS 3.1 base score of 6.5 (medium severity). Red Hat has released patches for affected packages in Red Hat Enterprise Linux 10 to mitigate this vulnerability.

The vulnerability causes denial of service through excessive CPU consumption during hostname verification in the crypto/x509 package. This can degrade or disrupt services performing TLS certificate verification, especially when certificates contain large DNS SAN lists. There is no confidentiality or integrity impact reported. No known exploits in the wild have been documented.

Red Hat has released updated golang packages for Red Hat Enterprise Linux 10 that address this vulnerability. Applying these official patches will remediate the issue. Since this is a denial of service vulnerability caused by inefficient processing, upgrading to the fixed package versions is the recommended mitigation. Patch status is confirmed by Red Hat advisories. No additional vendor advisories or temporary mitigations are indicated.