CVE-2025-61727: Golang Go Information Disclosure Flaw

CVE-2025-61727 Overview

CVE-2025-61727 affects the Go standard library's certificate chain validation logic. The flaw allows wildcard Subject Alternative Names (SANs) in a leaf certificate to bypass excluded subdomain Name Constraints set higher in the chain. For example, a constraint that excludes test.example.com fails to prevent a leaf certificate from asserting the SAN *.example.com. Applications relying on Go's crypto/x509 package to enforce certificate policy boundaries inherit this validation gap. The issue is tracked by the Go security team as GO-2025-4175 and classified under [CWE-295] Improper Certificate Validation.

Critical Impact

Certificate chains that rely on excluded subdomain Name Constraints can be bypassed using wildcard SANs in leaf certificates, weakening trust boundaries enforced by intermediate Certificate Authorities (CAs).

Affected Products

• Golang Go standard library crypto/x509
• Applications statically linked against vulnerable Go versions
• TLS services and clients using Go's built-in chain validation

Discovery Timeline

• 2025-12-03 - CVE-2025-61727 published to NVD
• 2025-12-18 - Last updated in NVD database

Technical Details for CVE-2025-61727

Vulnerability Analysis

Name Constraints are an X.509 extension that allows an issuing CA to limit the namespaces a subordinate CA may issue certificates for. The Go certificate verifier evaluates permittedDNSDomains and excludedDNSDomains against the DNS names in a leaf certificate's SAN extension. The vulnerability stems from incomplete matching logic when the SAN contains a wildcard. The verifier compares the excluded label test.example.com against *.example.com and treats them as non-overlapping, even though the wildcard would cover the excluded name during hostname matching at TLS time. Attackers controlling an intermediate CA constrained to specific subdomains can issue leaf certificates with wildcard SANs that cover names the constraint was designed to block. This breaks the integrity boundary that delegated PKI environments depend on.

Root Cause

The root cause is asymmetric semantics between the constraint check and runtime hostname verification. The constraint evaluator treats wildcards as literal strings rather than expanding them against the excluded namespace. As a result, the wildcard's coverage area is never compared to the exclusion set.

Attack Vector

An attacker who operates or compromises a subordinate CA constrained by excluded DNS subtrees can mint a leaf certificate with a wildcard SAN. Any Go-based TLS client or service performing chain validation will accept the leaf even though it covers names the parent CA explicitly excluded. The attacker can then present the certificate during a TLS handshake to impersonate hosts within the excluded namespace.

No verified proof-of-concept code is publicly available. Refer to the Go.dev Vulnerability Report and the Go.dev Change Log Entry for the upstream fix and reproduction details.

Detection Methods for CVE-2025-61727

Indicators of Compromise

• Leaf certificates containing wildcard SAN entries (*.example.com) issued by intermediate CAs that carry excludedSubtrees Name Constraints
• TLS handshakes presenting certificates whose wildcard SANs overlap excluded subdomains of any parent certificate in the chain
• Unexpected acceptance of certificate chains by Go-based services where validation was expected to fail

Detection Strategies

• Audit certificate transparency (CT) logs for wildcard SANs issued under intermediate CAs that publish Name Constraints
• Inventory internal services built with Go and identify the Go runtime version each binary was compiled against
• Run govulncheck against Go source trees and binaries to flag dependencies on vulnerable crypto/x509 code paths

Monitoring Recommendations

• Log full peer certificate chains at TLS termination points and alert on wildcard SANs presented by leaf certificates issued under constrained intermediates
• Track issuance from internal PKI for any leaf certificates that contain wildcards combined with constrained issuers
• Correlate TLS handshake telemetry with CT log entries to identify newly issued wildcard certificates targeting restricted namespaces

How to Mitigate CVE-2025-61727

Immediate Actions Required

• Upgrade all Go toolchains to the fixed release identified in GO-2025-4175 and rebuild affected binaries
• Recompile and redeploy any application that statically links the Go standard library, including container images and sidecars
• Review internal PKI hierarchies and confirm that constrained intermediates have not issued wildcard leaf certificates covering excluded subtrees

Patch Information

The Go team published the upstream fix in Go.dev Change Log Entry CL 723900. Tracking and version mapping are available in the Go.dev Vulnerability Report GO-2025-4175 and the Google Groups Announcement. Apply the patched Go release and rebuild dependent binaries; library consumers cannot remediate by patching only at runtime.

Workarounds

• Implement an additional verification callback using tls.Config.VerifyPeerCertificate to manually expand wildcard SANs and reject leaves that overlap excluded subtrees
• Restrict trusted CA bundles so that only intermediates without delegated wildcard authority can sign leaves accepted by the service
• Disallow wildcard SANs at internal CA issuance policy when the issuing intermediate carries excludedSubtrees constraints

# Verify the active Go toolchain version and scan modules for the advisory
go version
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...