CVE-2023-29409
golang: crypto/tls: slow verification of certificate chains containing large RSA keys
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · August 2, 2023
Updated · August 11, 2026
Description
A denial of service vulnerability was found in the Golang Go package caused by an uncontrolled resource consumption flaw. By persuading a victim to use a specially crafted certificate with large RSA keys, a remote attacker can cause a client/server to expend significant CPU time verifying signatures, resulting in a denial of service condition.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-400 · Uncontrolled Resource Consumption