Log in Start free

Vulnerability · Published Mar 6, 2026 · Assigned by Go

CVE-2026-27137Incorrect enforcement of email constraints in crypto/x509

High 7.5

In plain English

A high-severity improper certificate validation in crypto/x509 from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 48.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10delve1.25.2-3.el10_1ALSA-2026:8842
AlmaLinux:10go-toolset1.26.2-2.el10_2.alma.1ALSA-2026:19022
AlmaLinux:9go-toolset1.26.2-1.el9_8ALSA-2026:19181
AlmaLinux:10golang1.26.2-2.el10_2.alma.1ALSA-2026:19022
AlmaLinux:9golang1.26.2-1.el9_8ALSA-2026:19181
AlmaLinux:10golang-bin1.26.2-2.el10_2.alma.1ALSA-2026:19022
AlmaLinux:9golang-bin1.26.2-1.el9_8ALSA-2026:19181
AlmaLinux:10golang-docs1.26.2-2.el10_2.alma.1ALSA-2026:19022
AlmaLinux:9golang-docs1.26.2-1.el9_8ALSA-2026:19181
AlmaLinux:10golang-misc1.26.2-2.el10_2.alma.1ALSA-2026:19022
AlmaLinux:9golang-misc1.26.2-1.el9_8ALSA-2026:19181
AlmaLinux:10golang-race1.26.2-2.el10_2.alma.1ALSA-2026:19022
AlmaLinux:9golang-race1.26.2-1.el9_8ALSA-2026:19181
AlmaLinux:10golang-src1.26.2-2.el10_2.alma.1ALSA-2026:19022
AlmaLinux:9golang-src1.26.2-1.el9_8ALSA-2026:19181
AlmaLinux:10golang-tests1.26.2-2.el10_2.alma.1ALSA-2026:19022
AlmaLinux:9golang-tests1.26.2-1.el9_8ALSA-2026:19181
Alpine:v3.23go1.25.8-r0ALPINE-CVE-2026-27137
Alpine:v3.24go1.25.8-r0ALPINE-CVE-2026-27137
Alpine:v3.24rclone1.73.5-r0ALPINE-CVE-2026-27137
Debian:14golang-1.261.26.1-1DEBIAN-CVE-2026-27137
Gostdlib1.26.1GO-2026-4599
Rocky Linux:10delve0:1.25.2-3.el10_1RLSA-2026:8842
Rocky Linux:10golang0:1.26.2-2.el10_2RLSA-2026:19022
Rocky Linux:9golang0:1.26.2-1.el9_8RLSA-2026:19181
Rocky Linux:10image-builder0:52.1-1.el10_2.rocky.0.1RLSA-2026:22937
Rocky Linux:9image-builder0:52.1-1.el9_8RLSA-2026:23228
Rocky Linux:10osbuild-composer0:165.1-2.el10_2.rocky.0.1RLSA-2026:22450
Rocky Linux:9osbuild-composer0:165.1-2.el9_8.rocky.0.1RLSA-2026:22714
Ubuntu:22.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-27137
Ubuntu:24.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-27137
Ubuntu:25.10golang-1.24no fix listedUBUNTU-CVE-2026-27137
Ubuntu:26.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-27137
Ubuntu:22.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-27137
Ubuntu:24.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-27137
Ubuntu:25.10golang-1.25no fix listedUBUNTU-CVE-2026-27137
Ubuntu:26.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-27137
Ubuntu:22.04:LTSgolang-1.26no fix listedUBUNTU-CVE-2026-27137
Ubuntu:24.04:LTSgolang-1.26no fix listedUBUNTU-CVE-2026-27137
Ubuntu:26.04:LTSgolang-1.26no fix listedUBUNTU-CVE-2026-27137
Ubuntu:26.10golang-1.26no fix listedUBUNTU-CVE-2026-27137

Affected products (as reported)

VendorProductVersions
Go standard library crypto/x509 1.26.0-0 – before 1.26.1

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References