CVE-2018-16875

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.

• CWE-20
• CWE-295

• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html
• http://www.securityfocus.com/bid/106230Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16875Issue Tracking, Third Party Advisory
• https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0
• https://security.gentoo.org/glsa/201812-09Mitigation, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html
• http://www.securityfocus.com/bid/106230Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16875Issue Tracking, Third Party Advisory
• https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0
• https://security.gentoo.org/glsa/201812-09Mitigation, Third Party Advisory

Published

Dec 14, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16869A Bleichenbacher type side-channel based padding oracle atta…5.7
• CVE-2018-16870It was found that wolfssl before 3.15.7 is vulnerable to a n…
• CVE-2018-16871A flaw was found in the Linux kernel's NFS implementation, a…7.5
• CVE-2018-16872A flaw was found in qemu Media Transfer Protocol (MTP). The …5.3
• CVE-2018-16873In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" c…8.1
• CVE-2018-16874In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" c…8.1
• CVE-2018-16876ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable …5.3
• CVE-2018-16877A flaw was found in the way pacemaker's client-server authen…7.8
• CVE-2018-16878A flaw was found in pacemaker up to and including version 2.…5.5
• CVE-2018-16879Ansible Tower before version 3.3.3 does not set a secure cha…9.8
• CVE-2018-1688IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Ma…5.4
• CVE-2018-16880A flaw was found in the Linux kernel's handle_rx() function …7