CVE-2026-27137

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
References
Link Resource
https://go.dev/cl/752182 Mailing List
https://go.dev/issue/77952 Issue Tracking
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk Release Notes
https://pkg.go.dev/vuln/GO-2026-4599 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:10125
https://access.redhat.com/errata/RHSA-2026:10158
https://access.redhat.com/errata/RHSA-2026:10169
https://access.redhat.com/errata/RHSA-2026:10175
https://access.redhat.com/errata/RHSA-2026:10184
https://access.redhat.com/errata/RHSA-2026:10225
https://access.redhat.com/errata/RHSA-2026:10250
https://access.redhat.com/errata/RHSA-2026:10929
https://access.redhat.com/errata/RHSA-2026:11800
https://access.redhat.com/errata/RHSA-2026:13545
https://access.redhat.com/errata/RHSA-2026:14879
https://access.redhat.com/errata/RHSA-2026:19022
https://access.redhat.com/errata/RHSA-2026:19049
https://access.redhat.com/errata/RHSA-2026:19132
https://access.redhat.com/errata/RHSA-2026:19181
https://access.redhat.com/errata/RHSA-2026:19375
https://access.redhat.com/errata/RHSA-2026:21769
https://access.redhat.com/errata/RHSA-2026:22347
https://access.redhat.com/errata/RHSA-2026:22423
https://access.redhat.com/errata/RHSA-2026:22450
https://access.redhat.com/errata/RHSA-2026:22714
https://access.redhat.com/errata/RHSA-2026:22862
https://access.redhat.com/errata/RHSA-2026:22937
https://access.redhat.com/errata/RHSA-2026:23228
https://access.redhat.com/errata/RHSA-2026:23345
https://access.redhat.com/errata/RHSA-2026:26568
https://access.redhat.com/errata/RHSA-2026:26585
https://access.redhat.com/errata/RHSA-2026:28038
https://access.redhat.com/errata/RHSA-2026:28047
https://access.redhat.com/errata/RHSA-2026:29854
https://access.redhat.com/errata/RHSA-2026:36796
https://access.redhat.com/errata/RHSA-2026:39810
https://access.redhat.com/errata/RHSA-2026:41019
https://access.redhat.com/errata/RHSA-2026:41928
https://access.redhat.com/errata/RHSA-2026:5110
https://access.redhat.com/errata/RHSA-2026:5549
https://access.redhat.com/errata/RHSA-2026:7291
https://access.redhat.com/errata/RHSA-2026:8151
https://access.redhat.com/errata/RHSA-2026:8167
https://access.redhat.com/errata/RHSA-2026:8337
https://access.redhat.com/errata/RHSA-2026:8338
https://access.redhat.com/errata/RHSA-2026:8842
https://access.redhat.com/errata/RHSA-2026:9052
https://access.redhat.com/errata/RHSA-2026:9385
https://access.redhat.com/errata/RHSA-2026:9697
https://access.redhat.com/errata/RHSA-2026:9698
https://access.redhat.com/errata/RHSA-2026:9699
https://access.redhat.com/errata/RHSA-2026:9872
https://access.redhat.com/security/cve/CVE-2026-27137
https://bugzilla.redhat.com/show_bug.cgi?id=2445345
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27137.json
Configurations

Configuration 1 (hide)

cpe:2.3:a:golang:go:1.26.0:*:*:*:*:*:*:*

History

21 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:41928 -

17 Jul 2026, 13:18

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:41019 -

15 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:39810 -

09 Jul 2026, 13:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36796 -

30 Jun 2026, 03:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:10125 -
  • () https://access.redhat.com/errata/RHSA-2026:10158 -
  • () https://access.redhat.com/errata/RHSA-2026:10169 -
  • () https://access.redhat.com/errata/RHSA-2026:10175 -
  • () https://access.redhat.com/errata/RHSA-2026:10184 -
  • () https://access.redhat.com/errata/RHSA-2026:10225 -
  • () https://access.redhat.com/errata/RHSA-2026:10250 -
  • () https://access.redhat.com/errata/RHSA-2026:10929 -
  • () https://access.redhat.com/errata/RHSA-2026:11800 -
  • () https://access.redhat.com/errata/RHSA-2026:13545 -
  • () https://access.redhat.com/errata/RHSA-2026:14879 -
  • () https://access.redhat.com/errata/RHSA-2026:19022 -
  • () https://access.redhat.com/errata/RHSA-2026:19049 -
  • () https://access.redhat.com/errata/RHSA-2026:19132 -
  • () https://access.redhat.com/errata/RHSA-2026:19181 -
  • () https://access.redhat.com/errata/RHSA-2026:19375 -
  • () https://access.redhat.com/errata/RHSA-2026:21769 -
  • () https://access.redhat.com/errata/RHSA-2026:22347 -
  • () https://access.redhat.com/errata/RHSA-2026:22423 -
  • () https://access.redhat.com/errata/RHSA-2026:22450 -
  • () https://access.redhat.com/errata/RHSA-2026:22714 -
  • () https://access.redhat.com/errata/RHSA-2026:22862 -
  • () https://access.redhat.com/errata/RHSA-2026:22937 -
  • () https://access.redhat.com/errata/RHSA-2026:23228 -
  • () https://access.redhat.com/errata/RHSA-2026:23345 -
  • () https://access.redhat.com/errata/RHSA-2026:26568 -
  • () https://access.redhat.com/errata/RHSA-2026:26585 -
  • () https://access.redhat.com/errata/RHSA-2026:28038 -
  • () https://access.redhat.com/errata/RHSA-2026:28047 -
  • () https://access.redhat.com/errata/RHSA-2026:29854 -
  • () https://access.redhat.com/errata/RHSA-2026:5110 -
  • () https://access.redhat.com/errata/RHSA-2026:5549 -
  • () https://access.redhat.com/errata/RHSA-2026:7291 -
  • () https://access.redhat.com/errata/RHSA-2026:8151 -
  • () https://access.redhat.com/errata/RHSA-2026:8167 -
  • () https://access.redhat.com/errata/RHSA-2026:8337 -
  • () https://access.redhat.com/errata/RHSA-2026:8338 -
  • () https://access.redhat.com/errata/RHSA-2026:8842 -
  • () https://access.redhat.com/errata/RHSA-2026:9052 -
  • () https://access.redhat.com/errata/RHSA-2026:9385 -
  • () https://access.redhat.com/errata/RHSA-2026:9697 -
  • () https://access.redhat.com/errata/RHSA-2026:9698 -
  • () https://access.redhat.com/errata/RHSA-2026:9699 -
  • () https://access.redhat.com/errata/RHSA-2026:9872 -
  • () https://access.redhat.com/security/cve/CVE-2026-27137 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2445345 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27137.json -

21 Apr 2026, 14:40

Type Values Removed Values Added
References () https://go.dev/cl/752182 - () https://go.dev/cl/752182 - Mailing List
References () https://go.dev/issue/77952 - () https://go.dev/issue/77952 - Issue Tracking
References () https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk - () https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk - Release Notes
References () https://pkg.go.dev/vuln/GO-2026-4599 - () https://pkg.go.dev/vuln/GO-2026-4599 - Vendor Advisory
CWE CWE-295
CPE cpe:2.3:a:golang:go:1.26.0:*:*:*:*:*:*:*
First Time Golang go
Golang

10 Mar 2026, 18:18

Type Values Removed Values Added
Summary
  • (es) Al verificar una cadena de certificados que contiene un certificado con múltiples restricciones de dirección de correo electrónico que comparten porciones locales comunes pero porciones de dominio diferentes, estas restricciones no se aplicarán correctamente, y solo la última restricción será considerada.
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5

06 Mar 2026, 22:16

Type Values Removed Values Added
New CVE

Information

Published : 2026-03-06 22:16

Updated : 2026-08-04 13:17


NVD link : CVE-2026-27137

Mitre link : CVE-2026-27137

CVE.ORG link : CVE-2026-27137


JSON object : View

Products Affected

golang

  • go
CWE
CWE-295

Improper Certificate Validation