The vulnerability arises from the crypto/x509 package in the Go standard library, where the process of building certificate chains does not adequately limit the amount of work done when a large number of intermediate certificates are passed via VerifyOptions.Intermediates. This lack of throttling can lead to excessive resource consumption, resulting in a denial of service condition. The issue affects all versions up to 1.26.0-0 and impacts both direct usage of crypto/x509 and indirect usage through crypto/tls. The CVSS score is 7.5 (high severity), indicating network exploitable with no privileges or user interaction required, and impacts availability only.

The vulnerability can be exploited remotely without authentication or user interaction to cause a denial of service by exhausting system resources during certificate chain verification. There is no impact on confidentiality or integrity. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting the number of intermediate certificates passed to VerifyOptions.Intermediates as a temporary measure. Monitor official Go project advisories for updates and patches.