CVE-2025-61727CWE-295

CVE-2025-61727

Medium · published December 4, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
19.8
In the wild
Unconfirmed
What it is

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00284 · 19.8th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2025-12-04T01:16Z
Affected products (2)
ProductVersionsFixed in
golang/go< 1.24.111.24.11
golang/go≥ 1.25, < 1.25.51.25.5
References (4)
https://go.dev/cl/723900 · [email protected]https://go.dev/issue/76442 · [email protected]https://groups.google.com/g/golang-announce/c/8FJoBkPddm4 · [email protected]https://pkg.go.dev/vuln/GO-2025-4175 · [email protected]
EPSS history
Timeline
  • 03 DEC 19:37Z
    Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
    cvelistv5