CVE-2026-32281 is a denial of service vulnerability in the Go crypto/x509 package caused by inefficient validation of certificate chains containing a large number of policy mappings. This flaw leads to excessive resource consumption during validation, potentially causing performance degradation or denial of service in applications relying on this package. Exploitation requires a specially crafted certificate chain that is trusted, implying the attacker must have control over a trusted root certificate. Red Hat products using this Go package are affected, including Red Hat OpenShift Service Mesh and others. Red Hat has rated the impact as moderate and currently does not provide a mitigation that meets its standards. The vulnerability is tracked under CWE-1050 (Excessive Platform Resource Consumption within a Loop).

The vulnerability can cause denial of service by consuming excessive CPU and memory resources during certificate chain validation. This can degrade performance or cause unavailability of systems or applications performing such validation. No confidentiality, integrity, or privilege impacts are reported. Exploitation requires a trusted certificate chain, meaning the attacker must have compromised a trusted certificate authority or root certificate.

Red Hat currently does not provide a mitigation that meets its criteria for ease of use, deployment, applicability, or stability. Users are advised to monitor Red Hat advisories for updates. Since exploitation requires a trusted certificate chain, maintaining strict control over trusted certificate authorities and monitoring for compromised certificates is recommended. Red Hat Product Security continues to monitor the situation and may provide fixes or mitigations in future updates.