Vulnerability · Published Mar 6, 2026 · Assigned by Go
CVE-2026-27138Panic in name constraint checking for malformed certificates in crypto/x509
Medium 5.9
In plain English
A medium-severity security flaw in crypto/x509 from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.4%top 67.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | go | 1.25.8-r0 | ALPINE-CVE-2026-27138 |
| Alpine:v3.24 | rclone | 1.73.5-r0 | ALPINE-CVE-2026-27138 |
| Debian:14 | golang-1.26 | 1.26.1-1 | DEBIAN-CVE-2026-27138 |
| Go | stdlib | 1.26.1 | GO-2026-4600 |
| Ubuntu:22.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-27138 |
| Ubuntu:24.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-27138 |
| Ubuntu:25.10 | golang-1.24 | no fix listed | UBUNTU-CVE-2026-27138 |
| Ubuntu:26.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-27138 |
| Ubuntu:22.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-27138 |
| Ubuntu:24.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-27138 |
| Ubuntu:25.10 | golang-1.25 | no fix listed | UBUNTU-CVE-2026-27138 |
| Ubuntu:26.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-27138 |
| Ubuntu:22.04:LTS | golang-1.26 | no fix listed | UBUNTU-CVE-2026-27138 |
| Ubuntu:24.04:LTS | golang-1.26 | no fix listed | UBUNTU-CVE-2026-27138 |
| Ubuntu:26.04:LTS | golang-1.26 | no fix listed | UBUNTU-CVE-2026-27138 |
| Ubuntu:26.10 | golang-1.26 | no fix listed | UBUNTU-CVE-2026-27138 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | crypto/x509 | 1.26.0-0 – before 1.26.1 |