Go HostnameError Excessive Resource Consumption Vulnerability

A vulnerability exists in the Go programming language's standard library, specifically within the crypto/x509 package, in versions prior to 1.24.11 and between 1.25.0 and 1.25.5. The issue arises in the HostnameError.Error() method, where error strings are generated by concatenating hostnames without any limit. This unbounded concatenation can lead to excessive resource usage, as the operation has a quadratic runtime complexity. Consequently, a maliciously crafted certificate can cause significant resource exhaustion.

Impact

Exploitation of this vulnerability leads to excessive resource consumption, which can cause performance degradation or denial-of-service conditions.

Remediation

Users can upgrade to Go versions 1.24.11 or 1.25.5 to address this vulnerability.