Certificate verification panics when a chain contains a certificate with an empty DNS name and another certificate that has name constraints excluding that name. The panic aborts the verification routine and causes the program to terminate, producing a denial of service. Programs that directly verify X.509 chains or those that use TLS will crash. The weakness originates from unsafe error handling during name constraint checking and is identified as CWE‑295.

The affected component is the Go standard library package crypto/x509, which is used by all Go applications that validate certificates or establish TLS connections. Any Go program built with an unpatched standard library version is susceptible. The specific Go release numbers that contain the vulnerability are not listed in the input; the issue is documented by the Go team and fixed in later releases (see the referenced issue links).

With a CVSS score of 5.9 the vulnerability is of moderate severity and an EPSS score of less than 1 % indicates a very low probability of exploitation. It is not listed in the CISA KEV catalog. The most likely attack vector is remote, wherein an attacker supplies a crafted certificate chain—such as during an HTTPS handshake—to a server or client that performs TLS handshakes. The attacker must control the certificate chain; no privileged escalation is required, but the induced crash would deny service to users of the affected application.