Unrated severityNVD Advisory· Published Dec 3, 2025· Updated Dec 3, 2025
Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
CVE-2025-61727
Description
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
Affected products
1- Go standard library/crypto/x509v5Range: 0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.