CVE-2025-61727
BaseFortify
Publication date: 2025-12-03
Last updated on: 2025-12-18
Assigner: Go Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| golang | go | 1.25.0 |
| golang | go | 1.25.5 |
| golang | go | 1.24.11 |
| golang | go | From 1.25.0 (inc) to 1.25.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves an excluded subdomain constraint in a certificate chain that fails to restrict the usage of wildcard Subject Alternative Names (SANs) in the leaf certificate. Specifically, even if a constraint excludes a subdomain like test.example.com, the leaf certificate can still claim a wildcard SAN such as *.example.com, effectively bypassing the intended restriction.
How can this vulnerability impact me? :
This vulnerability can allow unauthorized certificates to be accepted for subdomains that were intended to be excluded, potentially enabling attackers to impersonate subdomains and intercept or manipulate secure communications.