CVE-2026-27137
Aliases:GO-2026-4599BIT-golang-2026-27137DEBIAN-CVE-2026-27137CGA-226c-637x-r3ccCGA-292j-5rc8-5vq3CGA-2966-vc8p-6g8rCGA-2crm-hcgx-2mmqCGA-2w9h-697x-w8r7CGA-3fmh-xw66-f29gCGA-3q7v-2m4h-p47jCGA-42c9-89gg-jq9gCGA-4pcm-7rqg-r2qfCGA-52mj-22r6-f6xvCGA-545x-jp35-4p3mCGA-5v66-6fc9-6f56CGA-5w3j-vwwf-7jqrCGA-649j-7j3h-3fhjCGA-7377-7qm8-q6v5CGA-744j-qvm6-r467CGA-759v-c293-pq4hCGA-7849-6mv8-mwj8CGA-7g7x-g583-qmcqCGA-7hhp-ghcf-ch3jCGA-7qpg-hcq9-j22qCGA-7w4j-2jmr-v9m4CGA-8538-pm8p-5g7xCGA-8ccp-7whr-p29xCGA-8fj8-7qgv-p43wCGA-8xv2-9qvq-3v5cCGA-9286-vw33-pj6jCGA-92pp-mmh8-5fxpCGA-9h83-8gfr-vr8pCGA-9qfp-gq83-jrwmCGA-cgj3-xjf3-m7r4CGA-cwpp-cvx9-cw54CGA-cxxx-4qg8-65qjCGA-f999-pfwv-96rhCGA-fc85-32f6-x4f6CGA-fm5h-66hh-rg47CGA-fph6-qhc5-rrx6CGA-fv8q-47gc-7vvxCGA-fvqx-qhrw-q9wgCGA-g8h4-rgmj-4wmrCGA-gfjf-xr85-j5qmCGA-h79v-fc3g-qf32CGA-hj56-9h4x-xr5qCGA-hpjm-w863-9r42CGA-j6r8-qgfg-ggwmCGA-jqqg-h25c-2v7pCGA-m8c9-g69f-pgpgCGA-mhp6-f95j-hv6mCGA-p5gp-2rjx-v7ppCGA-p98m-w23q-xvjcCGA-pc8x-fgrf-4g66CGA-pm7j-487j-cqjrCGA-2457-95mq-w8hvCGA-25g7-rfjf-3v36CGA-2658-rp44-32qvCGA-26gv-j7gf-qj9cCGA-28cm-3x52-p835CGA-295p-2gg7-4wjfCGA-2c5h-w7rm-674mCGA-2j56-j27p-3hc4CGA-2j73-jv25-w5f5CGA-2jj5-g6c5-fcchCGA-2mfh-xm6r-wm9mCGA-2v6j-q8hg-2hgxCGA-32rj-749c-7m24CGA-33mr-3h3q-j62mCGA-342f-mrh3-rq5pCGA-39fp-674r-qjqhCGA-3cxx-pxpc-72cpCGA-438m-2q4h-q79mCGA-45wh-9x2c-gq2fCGA-478f-f4gf-4grwCGA-4cr8-vv2g-w3qcCGA-4f54-8r47-2w97CGA-4fp5-xmx6-rfhpCGA-4hjp-cf36-q9fvCGA-4j93-x6mj-c5v8CGA-4j97-g756-94cvCGA-4pp6-3j8m-fmx6CGA-4x9v-3j56-qxh2CGA-5249-5xv3-j7cgCGA-566v-f3r8-vcf6CGA-56r3-pp7v-7cq4CGA-59qg-g6q5-gwpvCGA-59vj-7grc-g223CGA-5cqh-35p9-3fmhCGA-5g64-wx2q-g7xhCGA-5mm7-g7h2-3wq3CGA-5mmc-rqfr-wfgrCGA-5rwj-h3gh-w2r2CGA-5vfj-hh3x-g659CGA-5vwc-jj3w-mxh8CGA-63w2-m4cc-hpgqCGA-66p9-xq2m-4qhwCGA-6959-6289-fjjmCGA-6f2g-w4xc-25c9CGA-6hm6-9h35-mjpgCGA-6q5f-72gc-q2wxCGA-6q7h-59ch-8hrvCGA-6x9x-vgvp-gvxhCGA-73jj-2v2w-9qm8CGA-75fc-m77x-43qhCGA-768q-7crp-fw4rCGA-7ccm-hg47-4fxpCGA-7cx8-gp75-p6wvCGA-7fg8-8h73-8jc8CGA-7gpm-c3fr-rj78CGA-7pc3-9crw-g3jjCGA-7q8w-qr7p-rmrqCGA-7vmm-82fc-w858CGA-7xw2-4mf7-2jqwCGA-82mp-4ghw-x44vCGA-83jj-959w-8v27CGA-83p3-mw66-q72vCGA-84p6-6ccm-g6vcCGA-867q-q8r4-38g5CGA-87jj-f46w-5f54CGA-8mvj-534x-pq72CGA-8r8w-f54v-fxmwCGA-8rr5-wqfc-hrhmCGA-8v5m-vc47-4f8vCGA-97hc-4v7f-6ch5CGA-9fpv-v9cf-94cjCGA-9g2v-ff75-wcmcCGA-9q5h-j5m7-5vccCGA-9vgr-hpgg-7mrpCGA-c2rr-5f2m-5j7xCGA-c4mf-qr4r-j95jCGA-c56h-xr5m-9r86CGA-c79v-qc99-fpm8CGA-c9hv-mf75-c3wrCGA-c9mp-9792-3jg3CGA-crj4-3c22-46hjCGA-cw2v-phh4-r6wgCGA-cwrr-824v-vfcqCGA-cxph-2xwq-43rrCGA-f234-62m5-26xqCGA-f3h6-c6xv-57m7CGA-f3m9-587w-rcm2CGA-f4x8-cx8f-hcvhCGA-f55r-r8hx-mg4fCGA-f8wc-vf3w-xwmqCGA-ff3w-vgqx-cwfjCGA-fhg5-h325-g5hvCGA-fq7g-hj9x-g29vCGA-fqr4-c9cq-rw59CGA-frrx-4qvm-3ww5CGA-fvx4-c7vx-xc2cCGA-fx82-w35w-f4vxCGA-g2p2-p9m8-w8h3CGA-g45g-mfvf-2xgfCGA-g4r5-3m6c-38f8CGA-g6fh-h3mq-rqcvCGA-g7jg-q6rj-2fj6CGA-g7mq-xjqj-8f8fCGA-gfp2-p9pw-vq25CGA-gx8q-4qq8-p2vvCGA-gxvx-jxr2-rf5hCGA-h4gq-mxr8-x2g5CGA-h4m6-474w-f38mCGA-h935-j752-cm4wCGA-hcvx-42mm-pm86CGA-hp3f-hc69-fr43CGA-hv52-wrpq-ppp8CGA-hxqp-28jp-rfvqCGA-j6m8-78vj-wq6cCGA-j765-8wpx-52q5CGA-j7fq-ccfc-mfv2CGA-j8rq-hp35-j625CGA-jc8m-39pv-978mCGA-jcmg-fww7-4qfvCGA-jcrp-m77x-325jCGA-jgcw-fcpm-4h7wCGA-jh7x-5f8c-wvjxCGA-jm8f-jcxv-m7fmCGA-m34q-44xq-8jvmCGA-m4j6-r5f7-x2cpCGA-mg9p-xqrx-mwr4CGA-mm7m-jrfq-6rw6CGA-mmw5-wr7w-7xqpCGA-mvv5-fwc7-862hCGA-p856-hpp5-f42gCGA-p97v-rxcc-pj6rCGA-pjv4-jj7w-mgv6CGA-prv7-f45w-v9hcCGA-pv74-xv39-386gCGA-pwc9-c9vf-fxp5CGA-px4g-rgp5-5p57CGA-q38q-7fvr-4935CGA-q5c8-98w6-73qwCGA-q5wp-8hgm-336hCGA-q85p-rqhw-737cCGA-q95g-v9g8-vr6xCGA-q98m-cpm6-885jCGA-qcxq-xh8w-h23mCGA-qgwc-w2vg-vrxvCGA-qjwp-gwx6-v69gCGA-qmp3-hqv2-j44rCGA-qp95-cxc5-r7vqCGA-qq6c-jpj5-9v4jCGA-qw4q-mq7w-f82hCGA-qwjr-r42w-9jv6CGA-r22r-32r3-m2f2CGA-r257-m75j-65wxCGA-r2vc-qx54-pq9fCGA-r36c-53vr-m58mCGA-rc4q-3g95-4cq5CGA-rfwv-hp7c-v5wvCGA-rh2c-c4jc-6q44CGA-rj8m-2xmr-74vgCGA-rj9r-p7hv-mj3vCGA-rmxm-4mrf-x273CGA-rph5-xcm4-q8vwCGA-rv5q-mjmh-2928CGA-rwxp-f3vv-rqwqCGA-v2gj-rfjc-8h58CGA-v58r-x8qc-2wxfCGA-v6hc-2rv7-6632CGA-v6vf-46mw-r7rrCGA-vfvw-j665-qxr6CGA-vgmq-x75w-w4w7CGA-vmx7-jm46-9wc5CGA-vpwx-v27c-qp9pCGA-vrvr-g7c4-rrhhCGA-vw64-6mmg-235gCGA-vw88-wmgg-w5v7CGA-vw8w-frh9-69p9CGA-w239-h9qj-jx23CGA-w47g-9g4w-vg37CGA-w4rc-8452-f74qCGA-w5vp-pfvg-r2fwCGA-w6m9-cr4p-pq9xCGA-w92x-43cm-4wppCGA-wgw8-7p96-jmjfCGA-wh8f-2m6p-chpgCGA-wjmp-h34m-vqmcCGA-wmpv-9x6j-7vqwCGA-wvj3-xx3r-69q6CGA-wvvj-gcx6-8pv3CGA-x7h3-xxp7-278jCGA-xf73-fh7q-7m4rCGA-xhg4-59fw-vgpvCGA-xhmf-7g4v-cpqgCGA-xj2g-5hh2-xhw7CGA-xjgh-jrxw-ww3gCGA-xjpp-2v34-c84wCGA-xm8p-px26-2qqjCGA-xp6m-9jjq-99fhCGA-xp8r-95hf-qh2vCGA-xqh8-cpg7-58x8CGA-xr6c-57w2-4c92
Advisory lineage Upstream: 0 Downstream: 41
Modified
Published: 06 Mar 2026, 21:28
Last modified:18 Sept 2026, 12:04
Vulnerability Summary
Overall Risk (default)
medium
30/100 CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.61% LOW
1% probability +0.59%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
06 Mar 2026, 21:28
Published
Vulnerability first disclosed
18 Sept 2026, 12:04
Last Modified
Vulnerability information updated
Description
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.61%• Percentile: 48%
Techniques & Countermeasures
- CWE-295•Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Affected Systems
- chainguard•amazon-k8s-cni-fips
< 1.21.1-r6
- chainguard•amazon-k8s-cni-init-fips
< 1.21.1-r6
- chainguard•amazon-k8s-cni-init-fips-compat
< 1.21.1-r6
- chainguard•aws-ebs-csi-driver-1.56
< 1.56.0-r3
- chainguard•aws-ebs-csi-driver-fips-1.56
< 1.56.0-r3
- chainguard•aws-load-balancer-controller-fips
< 3.1.0-r1
- chainguard•boringssl-fips-static-2023042800-tools
< 0
- chainguard•boringssl-fips-static-20240407-tools
< 0
- chainguard•cert-manager-acmesolver-fips-1.18
< 1.18.6-r1
- chainguard•cert-manager-acmesolver-fips-1.19
< 1.19.4-r1
- chainguard•cert-manager-cainjector-fips-1.18
< 1.18.6-r1
- chainguard•cert-manager-cainjector-fips-1.19
< 1.19.4-r1
- chainguard•cert-manager-controller-fips-1.18
< 1.18.6-r1
- chainguard•cert-manager-controller-fips-1.19
< 1.19.4-r1
- chainguard•cert-manager-fips-1.18
< 1.18.6-r1
- chainguard•cert-manager-fips-1.19
< 1.19.4-r1
- chainguard•cert-manager-startupapicheck-fips-1.18
< 1.18.6-r1
- chainguard•cert-manager-startupapicheck-fips-1.19
< 1.19.4-r1
- chainguard•cert-manager-webhook-fips-1.18
< 1.18.6-r1
- chainguard•cert-manager-webhook-fips-1.19
< 1.19.4-r1
- chainguard•chainguard-partners-demo
< 0
- chainguard•cluster-autoscaler-fips-1.35
< 1.35.0-r0
- chainguard•dkron
< 4.1.0-r2
- chainguard•dkron-executor-gcppubsub
< 4.1.0-r2
- chainguard•dkron-executor-grpc
< 4.1.0-r2
- chainguard•dkron-executor-kafka
< 4.1.0-r2
- chainguard•dkron-executor-nats
< 4.1.0-r2
- chainguard•dkron-executor-rabbitmq
< 4.1.0-r2
- chainguard•dkron-processor-files
< 4.1.0-r2
- chainguard•dkron-processor-fluent
< 4.1.0-r2
- chainguard•dkron-processor-log
< 4.1.0-r2
- chainguard•dkron-processor-syslog
< 4.1.0-r2
- chainguard•flux-fips-2.8
< 2.8.1-r4
- chainguard•flux-helm-controller
< 1.5.3-r1
- chainguard•flux-image-automation-controller
< 1.1.1-r3
- chainguard•flux-image-reflector-controller
< 1.1.1-r1
- chainguard•flux-notification-controller
< 1.8.2-r1
- chainguard•flux-operator
< 0.45.0-r1
- chainguard•flux-operator-fips
< 0.43.0-r1
- chainguard•flux-operator-mcp
< 0.45.0-r1
- chainguard•flux-operator-mcp-fips
< 0.43.0-r1
- chainguard•flux-source-controller
< 1.8.1-r1
- chainguard•flux-source-watcher
< 2.1.1-r1
- chainguard•gitlab-container-registry-fips-18.7
< 18.7.5-r1
- chainguard•gitlab-container-registry-fips-18.8
< 18.8.5-r1
- chainguard•gitlab-container-registry-fips-18.9
< 18.9.1-r1
- chainguard•gitlab-logger-fips-18.7
< 0
- chainguard•gitlab-logger-fips-18.8
< 0
- chainguard•gitlab-logger-fips-18.9
< 0
- chainguard•gitlab-shell-fips-18.7
< 18.7.5-r1
Showing first 50 affected entries in server-rendered view.
References (71)
- https://go.dev/cl/752182
- https://go.dev/issue/77952
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
- https://pkg.go.dev/vuln/GO-2026-4599
- https://access.redhat.com/security/cve/CVE-2026-27137
- https://bugzilla.redhat.com/show_bug.cgi?id=2445345
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27137.json
- https://access.redhat.com/errata/RHSA-2026:28047
- https://access.redhat.com/errata/RHSA-2026:10929
- https://access.redhat.com/errata/RHSA-2026:8842
- https://access.redhat.com/errata/RHSA-2026:10169
- https://access.redhat.com/errata/RHSA-2026:19022
- https://access.redhat.com/errata/RHSA-2026:22937
- https://access.redhat.com/errata/RHSA-2026:19049
- https://access.redhat.com/errata/RHSA-2026:22450
- https://access.redhat.com/errata/RHSA-2026:19132
- https://access.redhat.com/errata/RHSA-2026:28038
- https://access.redhat.com/errata/RHSA-2026:19181
- https://access.redhat.com/errata/RHSA-2026:23228
- https://access.redhat.com/errata/RHSA-2026:22714
- https://access.redhat.com/errata/RHSA-2026:9872
- https://access.redhat.com/errata/RHSA-2026:26585
- https://access.redhat.com/errata/RHSA-2026:11800
- https://access.redhat.com/errata/RHSA-2026:22862
- https://access.redhat.com/errata/RHSA-2026:22423
- https://access.redhat.com/errata/RHSA-2026:22347
- https://access.redhat.com/errata/RHSA-2026:5110
- https://access.redhat.com/errata/RHSA-2026:21769
- https://access.redhat.com/errata/RHSA-2026:23345
- https://access.redhat.com/errata/RHSA-2026:29854
- https://access.redhat.com/errata/RHSA-2026:26568
- https://access.redhat.com/errata/RHSA-2026:8151
- https://access.redhat.com/errata/RHSA-2026:13545
- https://access.redhat.com/errata/RHSA-2026:7291
- https://access.redhat.com/errata/RHSA-2026:9052
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:5549
- https://access.redhat.com/errata/RHSA-2026:10158
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/errata/RHSA-2026:9697
- https://access.redhat.com/errata/RHSA-2026:9698
- https://access.redhat.com/errata/RHSA-2026:9699
- https://access.redhat.com/errata/RHSA-2026:9385
- https://access.redhat.com/errata/RHSA-2026:19375
- https://access.redhat.com/errata/RHSA-2026:14879
- https://access.redhat.com/errata/RHSA-2026:10125
- https://access.redhat.com/errata/RHSA-2026:10250
- https://access.redhat.com/errata/RHSA-2026:10225
- https://access.redhat.com/errata/RHSA-2026:8338
- https://access.redhat.com/errata/RHSA-2026:8337
- https://access.redhat.com/errata/RHSA-2026:8167
- https://access.redhat.com/errata/RHSA-2026:36796
- https://access.redhat.com/errata/RHSA-2026:41019
- https://access.redhat.com/errata/RHSA-2026:39810
- https://access.redhat.com/errata/RHSA-2026:41928
- https://security-tracker.debian.org/tracker/CVE-2026-27137
- https://access.redhat.com/errata/RHSA-2026:54757
- https://access.redhat.com/errata/RHSA-2026:49703
- https://access.redhat.com/errata/RHSA-2026:49702
- https://access.redhat.com/errata/RHSA-2026:56143
- https://access.redhat.com/errata/RHSA-2026:57649
- https://access.redhat.com/errata/RHSA-2026:49712
- https://access.redhat.com/errata/RHSA-2026:56223
- https://access.redhat.com/errata/RHSA-2026:61253
- https://pkg.go.dev
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27137.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-27137
- https://access.redhat.com/errata/RHSA-2026:67160
- https://access.redhat.com/errata/RHSA-2026:67159
- https://access.redhat.com/errata/RHSA-2026:67517
- https://access.redhat.com/errata/RHSA-2026:67518