What’s Vulnerable › Vulnerabilities

CVE-2026-27137: Incorrect enforcement of email constraints in crypto/x509

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-06 · updated 2026-09-16
• Weakness: CWE-295

Description

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

Affected products

• Go: 1.26.0
• Go Stdlib: from 1.26.0-0 before 1.26.1 — fixed in 1.26.1

How to fix

Upgrade to a fixed version: Go Stdlib 1.26.1. Check the vendor advisory for mitigations.

References

• https://go.dev/cl/752182
• https://go.dev/issue/77952
• https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
• https://pkg.go.dev/vuln/GO-2026-4599
• https://access.redhat.com/errata/RHSA-2026:10125
• https://access.redhat.com/errata/RHSA-2026:10158
• https://access.redhat.com/errata/RHSA-2026:10169
• https://access.redhat.com/errata/RHSA-2026:10175
• https://access.redhat.com/errata/RHSA-2026:10184
• https://access.redhat.com/errata/RHSA-2026:10225
• https://access.redhat.com/errata/RHSA-2026:10250
• https://access.redhat.com/errata/RHSA-2026:10929

Get alerted when CVE-2026-27137 or the next vulnerability affects your stack