The vulnerability arises from insufficient limits on the amount of work performed during certificate chain verification in the Go standard library's crypto/x509 package. Specifically, when many intermediate certificates are passed to VerifyOptions.Intermediates, the chain building process can consume excessive resources, leading to denial of service conditions. This affects applications using crypto/x509 directly as well as those using crypto/tls, which depends on crypto/x509 for certificate verification. No CVSS score or vendor advisory detailing patch status is currently available.

An attacker can cause a denial of service by supplying a large number of intermediate certificates, which triggers excessive resource consumption during certificate chain verification. This can degrade or halt the operation of applications relying on the affected Go libraries. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting the number of intermediate certificates processed or implementing application-level resource constraints to mitigate potential denial of service.