The vulnerability CVE-2026-32280 in the Go standard library's crypto/x509 package arises from insufficient limits on resource allocation during certificate chain building when a large number of intermediate certificates are passed in VerifyOptions.Intermediates. This can cause excessive work leading to denial of service conditions. Both direct users of crypto/x509 and users of crypto/tls are impacted. Red Hat has issued security advisories and patches for affected products including Red Hat Ansible Automation Platform 2.6. The CVSS v3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating a network-exploitable denial of service vulnerability without confidentiality or integrity impact.

The vulnerability allows an attacker to cause a denial of service by triggering excessive resource consumption during certificate chain verification. There is no impact on confidentiality or integrity. The denial of service can affect applications using the Go crypto/x509 and crypto/tls packages, potentially causing service disruption.

Official patches are available as per the Red Hat advisory RHSA-2026:24762 for Red Hat Ansible Automation Platform 2.6 and related products. Users should apply these updates to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the vendor-provided fixes.