Case Study How Showpo Rebuilt Its API Layer for a Global Headless Migration

CVE-2025-58187 High · CVSS 7.5 Medium Impact

crypto/x509: Name Constraint Validation Denial of Service via Quadratic Complexity

Exploitable under specific conditions

This CVE can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

Affects deployments where KrakenD validates TLS certificates from backends or clients that include name constraint extensions. Any TLS connection involving such certificates can trigger the quadratic processing path.

Component

Go standard library (crypto/x509)

Disclosed

Oct 8, 2025

CVSS Score

7.5

Description

The name constraint checking algorithm in Go’s crypto/x509 package has non-linear processing time for certain certificate inputs. Programs that validate arbitrary certificate chains — including those performing TLS verification against backends — can be forced into excessive CPU consumption by a certificate with carefully crafted name constraints. Fixed in Go 1.24.8 and Go 1.25.2. A follow-up fix addressing TLS validation failures for FQDNs with a trailing dot was released in CE 2.11.2 and EE 2.11.3.

Version summary

Community Edition

2.11.1

addresses this CVE

Affected CE versions

>= 2.0, < 2.11.1

Enterprise Edition

2.11.2

addresses this CVE

Affected EE versions

>= 2.0, < 2.11.2

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2025-58187 on NVD

Stay up to date with KrakenD releases and important updates