{"schema_version":"1.9.0","id":"BIT-golang-2025-61727","published":"2025-12-06T11:41:09.464Z","modified":"2026-09-08T08:47:49.785632550Z","aliases":["CVE-2025-61727","GO-2025-4175"],"summary":"Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509","details":"An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.","affected":[{"package":{"name":"golang","ecosystem":"Bitnami","purl":"pkg:bitnami/golang"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.24.11"},{"introduced":"1.25.0"},{"fixed":"1.25.5"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/golang/BIT-golang-2025-61727.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}],"references":[{"type":"FIX","url":"https://go.dev/cl/723900"},{"type":"REPORT","url":"https://go.dev/issue/76442"},{"type":"DISCUSSION","url":"https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61727"},{"type":"ADVISORY","url":"https://pkg.go.dev/vuln/GO-2025-4175"}],"database_specific":{"cpes":["cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"],"severity":"Medium"}}