Algorithmic DoS in Go crypto/x509 VerifyHostname via quadratic SAN parsing

#!/usr/bin/env bash
# check_cve_2026_27145.sh — Detect Go binaries vulnerable to CVE-2026-27145
# Usage: bash check_cve_2026_27145.sh /path/to/go-binary
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

BINARY="${1:-}"

if [[ -z "$BINARY" ]]; then
  echo "Usage: $0 /path/to/go-binary"
  exit 2
fi

if [[ ! -f "$BINARY" ]]; then
  echo "UNKNOWN — file not found: $BINARY"
  exit 2
fi

# Extract Go version from binary
GO_VERSION=$(go version "$BINARY" 2>/dev/null | grep -oP 'go[0-9]+\.[0-9]+\.?[0-9]*' | head -1)

if [[ -z "$GO_VERSION" ]]; then
  echo "UNKNOWN — could not determine Go version for $BINARY"
  exit 2
fi

echo "Detected Go version: $GO_VERSION"

# Parse major.minor.patch
VERSION_NUM=$(echo "$GO_VERSION" | sed 's/^go//')
MAJOR=$(echo "$VERSION_NUM" | cut -d. -f1)
MINOR=$(echo "$VERSION_NUM" | cut -d. -f2)
PATCH=$(echo "$VERSION_NUM" | cut -d. -f3)
PATCH=${PATCH:-0}

# Fixed in: go1.25.11+ or go1.26.4+
# Affected: all go < 1.25.11, and go 1.26.0 through 1.26.3

if [[ "$MAJOR" -lt 1 ]]; then
  echo "VULNERABLE — $GO_VERSION is affected by CVE-2026-27145"
  exit 1
fi

if [[ "$MAJOR" -eq 1 ]]; then
  if [[ "$MINOR" -lt 25 ]]; then
    echo "VULNERABLE — $GO_VERSION < go1.25.11"
    exit 1
  elif [[ "$MINOR" -eq 25 ]]; then
    if [[ "$PATCH" -lt 11 ]]; then
      echo "VULNERABLE — $GO_VERSION < go1.25.11"
      exit 1
    else
      echo "PATCHED — $GO_VERSION >= go1.25.11"
      exit 0
    fi
  elif [[ "$MINOR" -eq 26 ]]; then
    if [[ "$PATCH" -lt 4 ]]; then
      echo "VULNERABLE — $GO_VERSION < go1.26.4"
      exit 1
    else
      echo "PATCHED — $GO_VERSION >= go1.26.4"
      exit 0
    fi
  else
    # go1.27+ is not affected
    echo "PATCHED — $GO_VERSION is newer than affected range"
    exit 0
  fi
fi

echo "PATCHED — $GO_VERSION is newer than affected range"
exit 0