The vulnerability in Go's crypto/x509 and crypto/tls libraries arises from insufficient limits on the amount of work performed when building certificate chains with many intermediate certificates provided via VerifyOptions.Intermediates. This lack of throttling allows an attacker to cause excessive CPU and memory consumption, resulting in a denial of service condition. The issue impacts both direct users of crypto/x509 and crypto/tls. The CVSS v3.1 base score is 7.5 (High) with network attack vector, low complexity, no privileges or user interaction required, and availability impact only. Red Hat has published advisories confirming the vulnerability and its impact, and has released fixes in affected products such as Red Hat Ansible Automation Platform 2.6.

The vulnerability can cause denial of service by exhausting CPU and memory resources during certificate chain verification when processing untrusted TLS certificates with many intermediate certificates. This leads to service unavailability for legitimate users. There is no impact on confidentiality or integrity. The attack can be performed remotely without authentication or user interaction.

A fix is available and has been released by vendors including Red Hat in their Ansible Automation Platform 2.6 and related products. Users should apply the vendor-provided updates to remediate this vulnerability. No additional mitigations are specified or required beyond applying the official patches.