CVE-2026-32280 security vulnerability
Author: TortenschmeisserCreated May 12, 2026Updated May 12, 2026
crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
Target: usr/local/bin/usql_static
Type: gobinary
Fixed version: 1.25.9, 1.26.2
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
Source: xo/usql