The flaw is in the Go standard library crypto/x509 VerifyHostname routine, where the candidate hostname is parsed with strings.Split repeatedly for each DNS Subject Alternative Name entry. A large SAN list causes the verification cost to grow roughly with the square of the SAN count and hostname label count, leading to extreme CPU consumption. The impact is a denial of service through resource exhaustion, with no effect on confidentiality or integrity. Based on the description, it is inferred that an attacker can trigger this behavior by supplying a certificate containing an unusually large number of SAN entries during TLS handshake or any certificate validation routine.

This vulnerability affects all Go releases that contain the unpatched VerifyHostname implementation in the standard library component crypto/x509. The advisory does not list specific version numbers, but the issue was tracked in Go issue 79694 and was addressed in later Go releases; therefore all older Go distributions before the fix are impacted and should be updated.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of active exploitation. Nonetheless, the attack vector is straightforward—an attacker can present a certificate with a very large SAN list to a vulnerable application, forcing expensive hostname parsing and consuming excessive CPU, potentially leading to application or system unavailability. The risk is primarily availability; no known impact on confidentiality or integrity exists.