CVE-2025-58187: Go stdlib - Quadratic Complexity in Name Constraint Checking
Summary
CVE-2025-58187: Quadratic complexity when checking name constraints in crypto/x509. Affects stdlib across 2 version ranges.
< 1.24.9
>= 1.25.0, < 1.25.3
Fixed in 1.24.9 or 1.25.3, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-58187 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Go standard library (stdlib) is a collection of packages that provide essential functionalities for Go programming, including cryptography, networking, and data manipulation. The 'crypto/x509' package specifically handles the parsing and validation of X.509 certificates, which are crucial for secure communications. This package is widely used in applications that require secure connections, making its reliability paramount. However, a recent vulnerability has been identified that affects the efficiency of certificate validation, particularly in scenarios involving name constraints.
Vulnerability Detail
The vulnerability arises from the design of the name constraint checking algorithm within the 'crypto/x509' package. It exhibits quadratic complexity, meaning that the time taken to process certain inputs increases non-linearly with the size of the certificate. This can lead to significant performance degradation when validating arbitrary certificate chains, potentially causing denial-of-service conditions in applications that rely on this functionality. The vulnerability affects various methods within the package, including certificate verification and signature checks.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.24.91.24.9go get stdlib@v1.24.9 -
>= 1.25.0, < 1.25.31.25.3go get stdlib@v1.25.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider limiting the size of the certificate chains being validated or implementing additional checks to prevent excessively large inputs from being processed. However, this is not a substitute for applying the patch.
Conclusion
The CVE-2025-58187 vulnerability in the Go standard library's 'crypto/x509' package poses a significant risk to applications that rely on certificate validation. It is crucial for developers to update to the patched versions to mitigate potential performance issues and ensure the security of their applications.
See every vulnerability recorded for stdlib →
FAQ
CVE-2025-58187 is a vulnerability in the Go standard library's 'crypto/x509' package that leads to quadratic complexity in name constraint checking, affecting certificate validation performance.
Applications that validate certificate chains may experience significant performance issues, potentially leading to denial-of-service conditions under certain circumstances.
Versions prior to 1.24.9 and 1.25.0 to 1.25.2 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If an immediate update is not possible, consider implementing input size limitations or additional validation checks as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
