This vulnerability causes inefficient processing of certificate chains that contain a large number of policy mappings during validation by Go's crypto/x509 library. The excessive computational effort can consume CPU and memory resources, potentially leading to denial of service in applications that trust the chain. The weakness aligns with CWE‑1050, an inefficient algorithm, and also maps to CWE‑295.

The affected component is the Go standard library package crypto/x509 used for certificate chain verification. Any Go application that validates certificates against trusted roots, either through VerifyOptions.Roots or the system certificate pool, is impacted regardless of application type. The issue is present in all Go releases that include the vulnerable implementation; specific version numbers are not listed in the advisory.

With a CVSS score of 7.5, the vulnerability poses a moderate to high risk. The EPSS score is below 1%, suggesting current exploitation is unlikely, and it is not listed in the CISA KEV catalog. Attackers would need to supply a crafted certificate chain containing an unusually high number of policy mappings to a target application using the standard library for trusted validation. If successful, the attacker could cause elevated resource consumption and service interruption. No official patch is mentioned, so upgrading to a Go release that contains the fix is the best approach.