cve.bz

CVE-2018-16875

7.5 highEPSS 6.5%

High (7.5). EPSS 6.5% chance of exploitation in the next 30 days. Fixed in stdlib 1.10.6, 1.11.3.

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.

Severity

CVSS 3.0

7.5 high
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
6.5% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWEs
CWE-295, CWE-20
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GO-2022-0191Gostdlib<1.10.6
>=1.11.0-0 <1.11.3		1.10.6, 1.11.3

References

Check your stackJSON