The Wire · Showcase
CRYPTO/X509 HOSTNAME VERIFICATION CUT FROM QUADRATIC TO LINEAR
By RepoJournal · Filed · About Go
Go's x509 certificate verification just got exponentially faster for domains with large SAN lists, eliminating a pathological case that scaled by hostname labels times certificate entries.
The crypto/x509 package shipped a critical optimization [1] that eliminates quadratic behavior in VerifyHostname when processing certificates with dozens of Subject Alternative Name entries. Previously, matchHostnames looped over every SAN and called strings.Split on the same hostname each time, causing verification time to scale with SAN count multiplied by hostname label count. This gets you from O(n*m) to O(n) on the common path. Separately, debug/gosym [2] fixed symbol handling for generic functions by masking bracketed expressions rather than removing them, preserving string indices and improving support for instantiated generics. The tools team is tightening gopls code generation: addtest [3] now emits t.Context() for Go 1.24+ modules instead of context.Background(), while analysis passes are broadening their heuristics [4] to detect test-only symbols by file name, not just function name. Finally, golang/crypto addressed a resource exhaustion vulnerability [5] in SSH server authentication by capping total userauth attempts at 128 per connection, closing a loop that would process requests indefinitely if clients triggered PartialSuccessError responses.
Action items
- → Verify your x509 verification paths if you handle certs with 50+ SANs; this should visibly improve latency on update golang/go [plan]
- → Update golang/crypto if you run SSH servers exposed to untrusted clients golang/crypto [immediate]
- → Sync gopls if you're on Go 1.24 and use the 'Add test' code action golang/tools [monitor]
References
- [1] crypto/x509: split candidate hostname only once golang/go
- [2] debug/gosym: mask bracketed expressions rather than remove them golang/go
- [3] gopls/internal/golang: addtest: emit t.Context() for Go 1.24+ golang/tools
- [4] go/analysis/passes/inline: broaden "from own test" skip criterion golang/tools
- [5] ssh: cap total userauth attempts per server connection golang/crypto
FAQ
- What changed in Go on May 28, 2026?
- Go's x509 certificate verification just got exponentially faster for domains with large SAN lists, eliminating a pathological case that scaled by hostname labels times certificate entries.
- What should Go teams do about it?
- Verify your x509 verification paths if you handle certs with 50+ SANs; this should visibly improve latency on update • Update golang/crypto if you run SSH servers exposed to untrusted clients • Sync gopls if you're on Go 1.24 and use the 'Add test' code action
- Which Go repositories shipped on May 28, 2026?
- golang/go, golang/tools, golang/crypto