Go crypto/x509 (Tailscale, Go infra): Name-constraint checking scales non-linearly with certificate size

Impact

Name-constraint checking scales non-linearly with certificate size -> CPU exhaustion when validating chains

Who can reach it

Network (remote)

What to do

Control-plane: Go toolchain bump and rebuild of every TLS-validating service

References

Related entries

• Apache DolphinScheduler: exposed management endpoints leak database credentials to unauthenticated callersCVE-2025-62188 · Apache DolphinScheduler 3.1.x (exposed Spring Boot management endpoints)High
• Apache Airflow: pre-3.2 deployments lack the isolation guarantees operators assumed, per clarified security modelCVE-2025-66236 · Apache Airflow (workload isolation and JWT token authentication, deployments before 3.2.0)High
• IBM Storage Scale GUI (hardcoded inter-node token): A hardcoded token in the Storage Scale GUI source, usedCVE-2026-13460 · IBM Storage Scale GUI (hardcoded inter-node token)High
• Performance Co-Pilot: signed integer overflow in __pmGetPDU permanently blinds the collector daemonCVE-2026-16529 · Performance Co-Pilot pmcd/PMAPI (__pmGetPDU PDU length handling)High
• Automated Logic WebCTRL / i-Vu server and controllers, BACnet transport trust: This is the vendor formally concedingCVE-2026-32666 · Automated Logic WebCTRL / i-Vu server and controllers, BACnet transport trustHigh
• Apache Tomcat: Missing encryption of sensitive data introduced by the CVE-2026-29146 fixCVE-2026-34486 · Apache TomcatHigh