CVE-2026-32281Medium· 5.9▾ SunlitInefficient policy validation in crypto/x509
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.4%
— → 5.9
none → medium
5.9 → —
medium → none
— → 5.9
none → medium
0.4% → 0.4%
Last analysed / modified upstream
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.
This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
stdlib >= 1.26.0-0, < 1.26.2Upgrade to a patched release:
stdlib 1.26.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56862High· 7.5Limit handshake messages we are willing to accept post-handshake in crypto/tls
CVE-2026-56860High· 7.5Avoid quadratic complexity in resolvePath in net/url
CVE-2026-97031High· 7.5Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references
CVE-2026-97032High· 7.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
CVE-2026-97030Medium· 6.1A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped
CVE-2026-94448Medium· 6.1When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression