CVE-2026-32281

Description

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

How to fix CVE-2026-32281

To remediate CVE-2026-32281, upgrade the affected package to a fixed version below.

• —upgrade to 1.25.9 or later
• —no fix listed
• —no fix listed
• —no fix listed
• —upgrade to 1.25.9-1 or later
• —upgrade to 1.26.2-1 or later
• —upgrade to 1.25.9 or later

Is CVE-2026-32281 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

• from 0, < 1.25.9, >= 1.26.0-0, < 1.26.2
• from 0
• from 0
• from 0
• from 0, < 1.25.9-1
• from 0, < 1.26.2-1
• from 0, < 1.25.9, >= 1.26.0-0, < 1.26.2

CVSS scores

References (6)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-32281
• PATCHgo.dev/cl/758061
• REPORTgo.dev/issue/78281
• WEBgroups.google.com/g/golang-announce/c/0uYbvbPZRWU
• WEBnvd.nist.gov/vuln/detail/CVE-2026-32281