High · published December 3, 2025
⚡ Watch out! There's a sneaky flaw in HostnameError.Error() that can lead to excessive resource consumption from just one crafty certificate! 😱 It's like a restaurant serving an endless stream of appetizers on a busy night — the more hosts it tries to handle, the longer the lines grow, and sooner or later, the whole kitchen collapses under the pressure! An attacker can send a malicious certificate that results in an avalanche of error messages, consuming resources and potentially bringing your application to its knees. This could lead to service outages and a poor user experience, making your operations look unprofessional and unreliable!
It's like a restaurant serving an endless stream of appetizers on a busy night — the more hosts it tries to handle, the longer the lines grow, and sooner or later, the whole kitchen collapses under the pressure! This vulnerability allows an attacker to exploit the lack of limits in the error string construction within HostnameError.Error(), causing excessive resource consumption through repeated string concatenation, leading to quadratic runtime complexity.
An attacker can send a malicious certificate that results in an avalanche of error messages, consuming resources and potentially bringing your application to its knees. This could lead to service outages and a poor user experience, making your operations look unprofessional and unreliable! To mitigate this, ensure you limit the number of hostnames that can be printed in error messages. Consider refactoring the error handling mechanism to avoid repeated string concatenation, which can streamline performance. Always test for potential edge cases! 🔥 You've got this! With a few adjustments, you can fortify your application and keep it running smoothly! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| golang/go | < 1.24.11 | 1.24.11 |
| golang/go | ≥ 1.25.0, < 1.25.5 | 1.25.5 |