High severity · published Mar 6, 2026
CVE-2026-27137
Incorrect enforcement of email constraints in crypto/x509
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
crypto/x509 · Go standard library
1.26.0-0 before 1.26.1 · source: vendor
GO
GO · Golang
1.26.0 · source: NVD
AI
Assisted Installer for Red Hat OpenShift Container Platform 2 · Red Hat
All versions, or not specified · source: CISA
BF
Builds for Red Hat OpenShift 1.6.0 · Red Hat
All versions, or not specified · source: CISA
CC
Confidential Compute Attestation · Red Hat
All versions, or not specified · source: CISA
DV
Deployment Validation Operator · Red Hat
All versions, or not specified · source: CISA
DO
DevWorkspace Operator 0.4 · Red Hat
All versions, or not specified · source: CISA
EO
ExternalDNS Operator · Red Hat
All versions, or not specified · source: CISA
FA
Fence Agents Remediation Operator · Red Hat
All versions, or not specified · source: CISA
G3
Gatekeeper 3 · Red Hat
All versions, or not specified · source: CISA
LS
Logging Subsystem for Red Hat OpenShift · Red Hat
All versions, or not specified · source: CISA
LS
Logging Subsystem for Red Hat OpenShift 6.4 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27137
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27137
Mailing List
https://go.dev/cl/752182
Issue Tracking
https://go.dev/issue/77952
Release Notes
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
Vendor Advisory
https://pkg.go.dev/vuln/GO-2026-4599
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:10125
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:10158
More from crypto/x509
8.2
CVE-2026-33810
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
7.5
CVE-2026-32280
Unexpected work during chain building in crypto/x509
7.5
CVE-2026-32281
Inefficient policy validation in crypto/x509
7.5
CVE-2025-61729
Excessive resource consumption when printing error string for host certificate validation in crypto/x509
7.5
CVE-2025-58188
Panic when validating certificates with DSA public keys in crypto/x509