CVE-2018-16875 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2018-16875

CVE-2018-16875

Published:December 14, 2018

Updated:May 17, 2026

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.

Related Resources (19)

https://go.dev/issue/29233

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html

https://security.gentoo.org/glsa/201812-09

https://go.dev/cl/154105

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html

https://groups.google.com/g/golang-announce/c/Kw31K8G7Fi0

https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16875

https://rustsec.org/advisories/RUSTSEC-2023-0053.html

https://access.redhat.com/security/cve/CVE-2018-16875

http://www.securityfocus.com/bid/106230