CVE-2025-61727: Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

mediumCVSS 6.5CVE-2025-61727

CSIRTS triage

vendor: Go product: Go Authentication bypass

What: Wildcard DNS name verification in crypto/x509 incorrectly applies excluded name constraints, allowing certificate validation bypass.
Who is affected: Go applications performing TLS certificate verification with wildcard certificate names and name constraints.
Urgency: Medium severity with CVSS 6.5; potential for bypassing security controls warrants timely patching.
Action: Update Go runtime to a patched version with corrected x509 constraint validation.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Go

Get an email when a new Go advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: medium — CVSS 6.5
Published: 2026-08-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-61727

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2025-617270.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-61727	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

medium[UPDATE] [medium] Golang Go: Multiple vulnerabilitiescert-bund

Recent advisories for Improper application of

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-71443: CAI Content Credentials is affected by an Improper Input Validation vulnerability that could r…nvd · 2026-08-25
mediumCVE-2026-19639: An improper access control vulnerability exists where an authenticated non-administrative appl…nvd · 2026-08-14
mediumCVE-2026-48384: ColdFusion is affected by an Improper Input Validation vulnerability that could result in an a…nvd · 2026-08-11
unknownCVE-2026-27765: Improper input validation for some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before …nvd · 2026-08-11
unknownCVE-2026-20913: Improper input validation for some Intel(R) Neural Compressor software before version v3.7 wit…nvd · 2026-08-11
unknownCVE-2026-20769: Improper conditions check for the Intel(R) NPU Driver for all versions within Ring 3: User App…nvd · 2026-08-11