Description
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | golang | 1.10.6, 1.11.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | golang-1.8 +2 | No fix yet | — |
| Ubuntu 16.04 LTS | golang-1.6 +1 | No fix yet | — |
| Ubuntu 14.04 LTS | golang-1.10 | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLES 15 SP6 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLES 15 SP5 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLES 15 SP4 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLES 15 SP3 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | containerd | 1.2.5-5.13.1 | SUSE-SU-2019:1234-2 |
| SLES 15 SP1 | docker | 18.09.6_ce-6.17.1 | SUSE-SU-2019:1234-2 |
| SLES 15 SP1 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-6.18.1 | SUSE-SU-2019:1234-2 |
| SLES 15 SP1 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-4.12.1 | SUSE-SU-2019:1234-2 |
| SLES 15 SP1 | helm-mirror | 0.2.1-1.7.1 | SUSE-SU-2019:0048-2 |
| SLES 15 | containerd | 1.1.2-5.3.4 | SUSE-SU-2019:1234-1, SUSE-SU-2019:0495-1, SUSE-SU-2019:0286-1 |
| SLES 15 | docker | 18.06.1_ce-6.8.2 | SUSE-SU-2019:1234-1, SUSE-SU-2019:0495-1, SUSE-SU-2019:0286-1 |
| SLES 15 | docker-runc | 1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4 | SUSE-SU-2019:1234-1, SUSE-SU-2019:0495-1, SUSE-SU-2019:0286-1 |
| SLES 15 | golang-github-docker-libnetwork | 0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5 | SUSE-SU-2019:1234-1, SUSE-SU-2019:0495-1, SUSE-SU-2019:0286-1 |
| SLES 15 | helm-mirror | 0.2.1-1.7.1 | SUSE-SU-2019:0048-1 |
| SLES 12 SP5 | docker-stable | 24.0.9_ce-1.20.1 | SUSE-SU-2025:03540-1 |
| SLES 12 | containerd | 1.2.2-16.14.2 | SUSE-SU-2021:1458-1, SUSE-SU-2019:1264-1, SUSE-SU-2019:0573-1 |
| SLES 12 | docker | 18.09.1_ce-98.34.2 | SUSE-SU-2021:1458-1, SUSE-SU-2019:1264-1, SUSE-SU-2019:0573-1 |
| SLES 12 | docker-runc | 1.0.0rc6+gitr3748_96ec2177ae84-1.17.2 | SUSE-SU-2019:1264-1, SUSE-SU-2019:0573-1 |
| SLES 12 | golang-github-docker-libnetwork | 0.7.0.1+gitr2711_2cfbf9b1f981-16.2 | SUSE-SU-2019:1264-1, SUSE-SU-2019:0573-1 |
| SLES 12 | runc | 1.0.0~rc93-16.8.1 | SUSE-SU-2021:1458-1 |
| SLES for SAP 15 SP5 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLES for SAP 15 SP4 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLES for SAP 15 SP3 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLE HPC 15 SP5 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLE HPC 15 SP4 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLE HPC 15 SP3 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SUSE Package Hub 15 | go | 1.12-bp150.2.6.1 | openSUSE-SU-2019:1506-1 |
| SUSE Package Hub 15 | runc | 1.0.0~rc6-bp150.2.3.1 | openSUSE-SU-2019:0170-1 |
| SUSE Package Hub 12 SP3 | helm | 2.13.1-5.1 | openSUSE-SU-2019:1703-1 |
| SUSE OpenStack Cloud 6 | containerd | 1.2.2-16.14.2 | SUSE-SU-2019:0573-1 |
| SUSE OpenStack Cloud 6 | docker | 18.09.1_ce-98.34.2 | SUSE-SU-2019:0573-1 |
| SUSE OpenStack Cloud 6 | docker-runc | 1.0.0rc6+gitr3748_96ec2177ae84-1.17.2 | SUSE-SU-2019:0573-1 |
| SUSE OpenStack Cloud 6 | golang-github-docker-libnetwork | 0.7.0.1+gitr2711_2cfbf9b1f981-16.2 | SUSE-SU-2019:0573-1 |
| SUSE Enterprise Storage 7.1 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | containerd | 1.4.8-2.2 | openSUSE-SU-2024:10693-1 |
| openSUSE Tumbleweed | docker | 20.10.6_ce-2.1 | openSUSE-SU-2024:10722-1 |
| openSUSE Tumbleweed | docker-stable | 24.0.9_ce-15.1 | openSUSE-SU-2025:15589-1 |
| openSUSE Tumbleweed | etcd | 3.4.16-3.1 | openSUSE-SU-2024:10741-1 |
| openSUSE Tumbleweed | flannel | 0.14.0-1.2 | openSUSE-SU-2024:10761-1 |
| openSUSE Tumbleweed | go | 1.17-1.1 | openSUSE-SU-2024:10802-1 |
| openSUSE Tumbleweed | go1.10 | 1.10.8-8.2 | openSUSE-SU-2024:10803-1 |
| openSUSE Tumbleweed | go1.11 | 1.11.13-10.5 | openSUSE-SU-2024:10804-1 |
| openSUSE Tumbleweed | go1.12 | 1.12.17-4.8 | openSUSE-SU-2024:10805-1 |
| openSUSE Tumbleweed | helm | 3.6.3-1.1 | openSUSE-SU-2024:10841-1 |
| openSUSE Tumbleweed | helm-mirror | 0.3.1-1.9 | openSUSE-SU-2024:10842-1 |
| openSUSE Tumbleweed | helm3 | 3.19.2-1.1 | openSUSE-SU-2025:15779-1 |
| openSUSE Tumbleweed | runc | 1.0.2-1.2 | openSUSE-SU-2024:11358-1 |
| openSUSE Leap 15.6 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| openSUSE Leap 15.6 | etcd | 3.5.12-150000.7.6.1 | SUSE-SU-2024:3656-1 |
| openSUSE Leap 15.5 | etcd | 3.5.12-150000.7.6.1 | SUSE-SU-2024:3656-1 |
| openSUSE Leap 15.1 | containerd | 1.2.5-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | docker | 18.09.6_ce-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-lp151.3.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | go | 1.12-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | go1.11 | 1.11.9-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | go1.12 | 1.12.4-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.0 | containerd | 1.2.5-lp150.4.14.3 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | docker | 18.09.6_ce-lp150.5.17.2 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-lp150.5.21.2 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | go | 1.12-lp150.2.11.1 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | go1.11 | 1.11.9-lp150.9.3 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | go1.12 | 1.12.4-lp150.2.2 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-lp150.3.14.1 | openSUSE-SU-2019:1499-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
alexzorin/poc-cve-2018-16875 ★ 9 · Dec 14, 2018
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | < 1.10.6 · >= 1.11.0-0, < 1.11.3 | 1.10.6, 1.11.3 | GO-2022-0191 |
Advisories 31
- openSUSE-SU-2025:15589-1 docker-stable-24.0.9_ce-15.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:03545-1 Security update for docker-stable SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2019:0048-1 Security update for helm-mirror SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1234-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:4297-1 Security update for containerd, docker and go SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10761-1 flannel-0.14.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10803-1 go1.10-1.10.8-8.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1444-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0573-1 Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1499-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1703-1 Security update for helm SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11358-1 runc-1.0.2-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0495-1 Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10842-1 helm-mirror-0.3.1-1.9 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1264-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10741-1 etcd-3.4.16-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10693-1 containerd-1.4.8-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10722-1 docker-20.10.6_ce-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0048-2 Security update for helm-mirror SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10804-1 go1.11-1.11.13-10.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15779-1 helm3-3.19.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1234-2 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10841-1 helm-3.6.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:0170-1 Security update for runc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3656-1 Security update for etcd SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1506-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03540-1 Security update for docker-stable SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10805-1 go1.12-1.12.17-4.8 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0286-1 Security update for docker SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1458-1 Security update for containerd, docker, runc SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10802-1 go-1.17-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 106230 vdb-entry
- GLSA-201812-09 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16875
- https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0
- openSUSE-SU-2019:1079 vendor-advisory
- openSUSE-SU-2019:1444 vendor-advisory
- openSUSE-SU-2019:1499 vendor-advisory
- openSUSE-SU-2019:1506 vendor-advisory
- openSUSE-SU-2019:1703 vendor-advisory