CVE-2026-27137
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
- Score
- CVSS 3.1 7.5 High
- Status
- Modified - security@golang.org
- Published
- 2026-03-06
- Last modified
- 2026-09-18
- Weaknesses
- CWE-295
Affected products
- Cryptox509 (Go Standard Library)
- Go (Golang)
- Acm (Redhat)
- Advanced Cluster Security (Redhat)
- Amq Streams (Redhat)
- Ansible Automation Platform (Redhat)
- Apache Camel Hawtio (Redhat)
- Assisted Installer (Redhat)
- Cert Manager (Redhat)
- Certifications (Redhat)
- Confidential Compute Attestation (Redhat)
- Connectivity Link (Redhat)
- Container Native Virtualization (Redhat)
- Cryostat (Redhat)
- Deployment Validator Operator (Redhat)
- Devworkspace (Redhat)
- Edge Manager (Redhat)
- Enterprise Linux (Redhat)
- Enterprise Linux Ai (Redhat)
- Enterprise Linux Eus (Redhat)
- Ext Dns Optr (Redhat)
- External Secrets Operator (Redhat)
- Gatekeeper (Redhat)
- Hummingbird (Redhat)
- Lightspeed For Runtimes (Redhat)
- Logging (Redhat)
- Lvms (Redhat)
- Migration Toolkit Applications (Redhat)
- Mirror Registry (Redhat)
- Multicluster Engine (Redhat)
- Multicluster Globalhub (Redhat)
- Network Observ Optr (Redhat)
- Ocp Tools (Redhat)
- Openshift (Redhat)
- Openshift Ai (Redhat)
- Openshift Api Data Protection (Redhat)
- Openshift Builds (Redhat)
- Openshift Cluster Manager Cli (Redhat)
- Openshift Compliance Operator (Redhat)
- Openshift Custom Metrics Autoscaler (Redhat)
- Openshift Data Foundation (Redhat)
- Openshift Devspaces (Redhat)
- Openshift Distributed Tracing (Redhat)
- Openshift File Integrity Operator (Redhat)
- Openshift Gitops (Redhat)
- Openshift Lightspeed (Redhat)
- Openshift Pipelines (Redhat)
- Openshift Power Monitoring (Redhat)
- Openshift Security Profiles Operator (Redhat)
- Openshift Service On Aws (Redhat)
- Openstack (Redhat)
- Quay (Redhat)
- Red Hat 3scale Amp (Redhat)
- Rhdh (Redhat)
- Rhel E4s (Redhat)
- Rhel Eus (Redhat)
- Rhmt (Redhat)
- Satellite (Redhat)
- Serverless (Redhat)
- Service Interconnect (Redhat)
- Service Mesh (Redhat)
- Stf (Redhat)
- Trusted Artifact Signer (Redhat)
- Webterminal (Redhat)
- Windows Machine Config (Redhat)
- Workload Availability Far (Redhat)
- Workload Availability Mdr (Redhat)
- Workload Availability Nhc (Redhat)
- Zero Trust Workload Identity Manager (Redhat)
References
- https://go.dev/cl/752182
- https://go.dev/issue/77952
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
- https://pkg.go.dev/vuln/GO-2026-4599
- https://access.redhat.com/errata/RHSA-2026:10125
- https://access.redhat.com/errata/RHSA-2026:10158
- https://access.redhat.com/errata/RHSA-2026:10169
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:10225
- https://access.redhat.com/errata/RHSA-2026:10250
- https://access.redhat.com/errata/RHSA-2026:10929
- https://access.redhat.com/errata/RHSA-2026:11800
- https://access.redhat.com/errata/RHSA-2026:13545
- https://access.redhat.com/errata/RHSA-2026:14879
- https://access.redhat.com/errata/RHSA-2026:19022
- https://access.redhat.com/errata/RHSA-2026:19049
- https://access.redhat.com/errata/RHSA-2026:19132
- https://access.redhat.com/errata/RHSA-2026:19181
- https://access.redhat.com/errata/RHSA-2026:19375
- https://access.redhat.com/errata/RHSA-2026:21769
- https://access.redhat.com/errata/RHSA-2026:22347
- https://access.redhat.com/errata/RHSA-2026:22423
- https://access.redhat.com/errata/RHSA-2026:22450
- https://access.redhat.com/errata/RHSA-2026:22714
- https://access.redhat.com/errata/RHSA-2026:22862
- https://access.redhat.com/errata/RHSA-2026:22937
- https://access.redhat.com/errata/RHSA-2026:23228
- https://access.redhat.com/errata/RHSA-2026:23345
- https://access.redhat.com/errata/RHSA-2026:26568
