CVE-2025-61727

Published Dec 3, 2025

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-61727 refers to a security vulnerability found in Go versions 1.25.5 and 1.24.11. Specifically, an excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example, a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com. This vulnerability could allow a malicious actor to bypass intended security restrictions related to certificate validation. The issue is addressed in Go versions 1.25.5 and 1.24.11.

Description: An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
Source: security@golang.org
NVD status: Analyzed
Products: go

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.5
Impact score: 2.5
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-295

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F2E6FD2A-A487-4099-B91D-2429F286AC6D",
            "versionEndExcluding": "1.24.11"
          },
          {
            "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EC1866EE-ABDC-4F74-9657-70A1241D49BD",
            "versionEndExcluding": "1.25.5",
            "versionStartIncluding": "1.25"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.