CVE-2026-27137
Incorrect enforcement of email constraints in crypto/x509
- State
- Published
- Severity
- 7.5 High
- Published
- Mar 6, 2026
- Updated
- Sep 18, 2026
- Reserved
- Feb 17, 2026
Description
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | redhat-SADP |
Weaknesses
- CWE-295 Improper Certificate Validation
Affected Products
| Product | Versions |
|---|---|
crypto/x509Go standard library |
|
References
- https://go.dev/cl/752182
- https://go.dev/issue/77952
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
- https://pkg.go.dev/vuln/GO-2026-4599
- https://access.redhat.com/security/cve/CVE-2026-27137vdb-entry
- RHBZ#2445345issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27137.json
- https://access.redhat.com/errata/RHSA-2026:41019vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:54757vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:36796vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:28047vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:39810vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:49703vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:49702vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:67517vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:56143vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:10929vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:8842vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:10169vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:19022vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:22937vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:19049vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:22450vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:19132vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:61253vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:67160vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:57649vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:67159vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:49712vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:67518vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:56223vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:28038vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:19181vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:23228vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:22714vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:5549vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:9872vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:22862vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:11800vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:26585vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:22423vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:22347vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:23345vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:29854vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:26568vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:8151vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:13545vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:7291vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:9052vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:41928vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:10184vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:10158vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:10175vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:9697vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:9698vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:9699vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:9385vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:19375vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:14879vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:10125vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:10250vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:10225vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:8338vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:8337vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:8167vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:5110vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:21769vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.