Go Name Constraint Checking Algorithm Performance Vulnerability

A vulnerability exists in the Go programming language's standard library, specifically in the 'crypto/x509' package, prior to version 1.24.9 and between versions 1.25.0 and 1.25.3. The issue arises from the name constraint checking algorithm, which can lead to quadratic complexity in processing times for certain inputs, scaling non-linearly with the size of the certificate. This vulnerability impacts programs that validate arbitrary certificate chains.

Impact

The vulnerability can cause excessive CPU consumption when validating certificates with complex name constraints, potentially leading to denial-of-service conditions.

Remediation

Users can upgrade to Go versions 1.24.9 or 1.25.3 and later to address this vulnerability.