← Back

CVE-2026-27137

nvd nist
Published: Mar 6, 2026Modified: Apr 21, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

Affected (1)

Products: Golang: Go
Golang
1 product
Go
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Go
Version 1.26.0

Related CWEs

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.

References (4)

Source: security@golang.org
Mailing List
Source: security@golang.org
Issue Tracking
Source: security@golang.org
Release Notes
Source: security@golang.org
Vendor Advisory

Timeline

No history available yet.