CVE-2022-41724 Panic on large handshake records in crypto/tls

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Cause Panic in Go's Certificate Validation Two vulnerabilities have been identified in Go's crypto/x509 package affecting TLS clients. CVE-2022-27536, published on April 20, 2022, allows a remote TLS server to cause a panic on macOS with malformed certificates. CVE-2025-58188, published on October 29, 2025, results in a panic when validating certificates with DSA public keys. 3 sources 46