CVE-2026-27138

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-27138
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://go.dev/cl/752183 Mailing List
https://go.dev/issue/77953 Issue Tracking
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk Release Notes
https://pkg.go.dev/vuln/GO-2026-4600 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:golang:go:1.26.0:*:*:*:*:*:*:*
History

21 Apr 2026, 14:39

Type Values Removed Values Added
First Time Golang go
Golang
References () https://go.dev/cl/752183 - () https://go.dev/cl/752183 - Mailing List
References () https://go.dev/issue/77953 - () https://go.dev/issue/77953 - Issue Tracking
References () https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk - () https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk - Release Notes
References () https://pkg.go.dev/vuln/GO-2026-4600 - () https://pkg.go.dev/vuln/GO-2026-4600 - Vendor Advisory
CWE CWE-295
CPE cpe:2.3:a:golang:go:1.26.0:*:*:*:*:*:*:*

10 Mar 2026, 18:18

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.9
Summary
  • (es) La verificación de certificados puede entrar en pánico cuando un certificado en la cadena tiene un nombre DNS vacío y otro certificado en la cadena tiene restricciones de nombre excluidas. Esto puede bloquear programas que están verificando directamente cadenas de certificados X.509, o aquellos que usan TLS.

06 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-06 22:16

Updated : 2026-04-21 14:39

NVD link : CVE-2026-27138

Mitre link : CVE-2026-27138

CVE.ORG link : CVE-2026-27138

JSON object : View

Products Affected

golang

  • go
CWE
CWE-295

Improper Certificate Validation