CVE-2026-27138
Aliases:GO-2026-4600BIT-golang-2026-27138DEBIAN-CVE-2026-27138CGA-2474-pxpq-p85wCGA-263h-mhpm-w4rrCGA-267m-72fq-9jx8CGA-2fpj-9vcq-2pp6CGA-2xm2-42jm-7p9vCGA-33x4-rcm9-7w6cCGA-35rr-ff5g-45j5CGA-38g4-3cm5-gj3cCGA-3jjh-jm54-hrm5CGA-3q67-m9jg-9jc4CGA-4hgj-4gx8-x5pvCGA-4mxc-xp2q-327pCGA-4ph6-w6fx-9ffvCGA-4v97-m8p2-7g99CGA-53vv-xmv8-q2gmCGA-599v-h575-vcf3CGA-5hm7-m39j-p5f2CGA-653f-x73m-fp4fCGA-66c2-jc76-xq2mCGA-67jp-m7fc-g57jCGA-6vgr-36x5-jcg3CGA-6w6v-cv49-34v9CGA-72qv-w3w2-m2vvCGA-7592-24xv-m5ghCGA-76jx-v2jc-577wCGA-78h5-vmpc-vv3pCGA-7f8p-269m-6r7pCGA-7v79-wm35-rxqhCGA-84fv-r2q7-w2wxCGA-88wj-22w2-hm7pCGA-8jp5-4vgm-pmw9CGA-9hp8-97vx-mh3fCGA-c726-52j8-44qmCGA-c9pj-rfvf-r4rfCGA-cfhj-33pw-qhx6CGA-cgww-jpf6-74jhCGA-cm35-424m-ccc9CGA-cr47-cmr4-3895CGA-f24g-xr8q-jw6cCGA-fmrr-mhp2-r59pCGA-h75r-h4jj-h79jCGA-hphv-26vh-4ggfCGA-jc3q-h6j7-m3vgCGA-jqjq-p6j9-2wm5CGA-jxm8-xx96-58xhCGA-jxw4-52qg-8w5hCGA-m36j-6mq2-7gr2CGA-m3j4-jp24-xw95CGA-m469-c4w4-pv24CGA-m47p-2qgj-crcxCGA-m664-jp92-3h26CGA-m92f-682m-234rCGA-m9gx-5q7q-m8j4CGA-mww3-5hx6-5q93CGA-p3rh-vw32-g68mCGA-p4rw-gg63-q9j5CGA-pcwq-43mq-mhp9CGA-22fx-rpw3-2wwhCGA-22xg-qjx4-p8vvCGA-25rq-hv9r-wvmpCGA-264p-r3p3-pccjCGA-2q6m-73rr-6v7vCGA-2vw3-p4cc-fr59CGA-2xwq-5j52-f7w4CGA-32q6-89p5-5qw2CGA-33pw-x842-j98fCGA-34wx-v96x-7w74CGA-35qm-v49v-34mpCGA-36gq-vg5c-px7cCGA-3f7h-g9vf-ffgpCGA-3h9f-rj87-97xwCGA-3jhx-p422-3wxjCGA-3q7x-qfgp-3p53CGA-3v6r-hq7g-f2qcCGA-3wv9-8mv9-qm22CGA-3x65-78gq-89r9CGA-4333-v754-qjr5CGA-4464-7wp6-c4w5CGA-44ch-f9gq-c5m2CGA-46fw-25v3-5vx5CGA-474q-8wmh-vmmwCGA-48p3-hwww-9r79CGA-497v-5g87-8hj7CGA-499g-qm9j-cp8xCGA-49x4-9g53-m6whCGA-4h3f-xgx6-fpwjCGA-4j28-r72h-f86pCGA-4jq2-qmx2-6g2jCGA-4w4j-pcw3-6fv2CGA-54cp-7hff-f3mmCGA-55r6-w57g-vcx9CGA-57cv-vhv8-37fcCGA-57fw-3r7v-2xfrCGA-5gm9-p35v-h5w2CGA-5jvj-m73v-c5wqCGA-5q7h-2ggq-mgpfCGA-5qx3-hjvx-3wjfCGA-5rm5-rpjr-jx4mCGA-632w-74gq-66j6CGA-6622-j5fh-92r4CGA-675p-m6cq-897xCGA-6fg2-h3p8-947pCGA-6ghp-4cp9-6x86CGA-6j2m-qfv6-4m54CGA-6jv3-8623-66qmCGA-6mh7-xfc7-6crqCGA-6w23-vh4h-xhmmCGA-72rm-47vv-2h57CGA-74q7-vcvm-xp5vCGA-7568-3whw-cw9vCGA-7gwp-xw24-vm68CGA-7hwc-jgq5-vgjxCGA-7mj3-cmcm-gxp5CGA-7mqj-wgw5-j5cwCGA-7q25-wjjj-39fpCGA-7qmv-3w4g-qvpmCGA-839w-w8v7-29h7CGA-888f-3mx3-gg77CGA-88w3-pgv8-p836CGA-8922-jc5m-9mmgCGA-8cmh-qvjh-rp83CGA-8g55-w5hv-7qjcCGA-8h8q-777q-928wCGA-8hp4-hm4f-5hfmCGA-8j4w-xgjr-jrm9CGA-8qq8-26qr-f3v5CGA-8rcx-98fr-m2v3CGA-93jf-64f9-rrcvCGA-93q9-8q2c-m4cxCGA-98ff-4qp8-99vpCGA-98wv-8w4g-v7hhCGA-98xp-mcr4-83vmCGA-9g3g-j5m9-3mxpCGA-9ghj-56gg-q347CGA-9j69-vwpv-cxfvCGA-9qfx-466c-677wCGA-9rh4-h58f-gc6cCGA-9wxx-926c-xhmhCGA-9xvh-5pg8-v2jwCGA-c3pm-63hv-vpxwCGA-c3px-4f2r-m6g7CGA-c4xq-3h42-pjq9CGA-c5fg-pc3c-6299CGA-c8vv-379c-6fc8CGA-cf7w-prv4-jgxjCGA-cpxm-p539-vwq9CGA-cvmh-qvxx-357rCGA-cvvr-7257-q274CGA-cx6q-2rxm-xwv6CGA-f45x-572c-766hCGA-f6hh-g68v-rcg3CGA-fjr8-9qvw-7xccCGA-g324-46c8-hwffCGA-g3v5-p45j-97rhCGA-g6c3-q42q-m6v2CGA-g7pc-c9q5-c632CGA-g7rr-9cqg-29q7CGA-gc94-4p8c-qwqxCGA-gj26-gqmv-74mqCGA-gpjp-9cj6-hp23CGA-gw3c-x87c-wx8fCGA-h7qj-wj54-997rCGA-h9pj-gmg3-wpg4CGA-hhmq-xmm6-cqvwCGA-j3hv-37cq-5prrCGA-j5h5-xr8x-8jq5CGA-j77x-wjw6-5vg4CGA-j8r6-mv43-88mjCGA-j99m-396r-62q5CGA-jrvp-h525-p37gCGA-jv4j-4q7r-vc2fCGA-m455-mfw5-h275CGA-m6h8-6jrg-8q34CGA-m86m-x4gc-m279CGA-m8v7-mf6c-74hcCGA-m9x7-72gc-773jCGA-mjg8-2mp9-mwmcCGA-mjh7-cmww-9vwvCGA-mp6h-8rhx-jjvjCGA-mw6q-mrjg-h4jwCGA-mwjm-qxmv-hg2jCGA-p54c-p3mc-fvwrCGA-p795-x5gg-m66jCGA-p7wc-8w5q-3pg4CGA-p8cj-7c3v-55xxCGA-p95j-j853-xj82CGA-pc28-4vc2-5v4qCGA-pcgj-gjrg-53g9CGA-pfrh-xp67-cc4rCGA-ph7c-px4c-vw7hCGA-pj82-2642-xgcxCGA-pp28-hmwq-xm7wCGA-pp8q-rg9x-6v6cCGA-pvjw-jxmp-2fmvCGA-q26h-fcf5-6hf5CGA-q6pj-mqp3-4cxrCGA-q8gp-33xw-86rqCGA-qfgx-64mr-qrpmCGA-qmqp-xw88-2266CGA-qw3j-jgwf-985gCGA-qwvw-483w-6w6xCGA-qwx9-8363-xv2jCGA-qx48-v4mj-r8qpCGA-r4wm-38c8-6hp6CGA-r67q-84f3-799rCGA-r6qx-jrjv-3fg4CGA-r7rq-5j37-95r8CGA-rf5g-cj76-x6qwCGA-rghm-88g4-8525CGA-rj94-c93j-mvh5CGA-rm88-8w22-6xcjCGA-rmp8-h76f-m5r8CGA-rqj2-v8fq-x6crCGA-rqvv-rf6j-7rp5CGA-rr7g-6qgm-9xpwCGA-rrgw-27mj-cg6vCGA-rvcc-7g69-7gq6CGA-rvjw-ff97-vvfwCGA-v29j-9j84-qj9cCGA-v2q7-m9x9-gc58CGA-v4cv-4hgh-3rpvCGA-v88x-g27v-9vq2CGA-vc9r-5f4r-pp7pCGA-vch4-r6f9-j3phCGA-vg5g-wpx8-hwvxCGA-vg9f-pxgh-47pwCGA-vgxw-92wf-c2vjCGA-vhm5-56cw-2mjrCGA-vjrf-f9pg-cr9hCGA-vjxg-p393-2r8jCGA-vm6g-pw5c-g7fcCGA-vmx5-6hgf-jfc2CGA-w4hp-4qhw-c3j6CGA-w52w-4m98-r55mCGA-w7hx-wh2q-p3pcCGA-wc4g-v8r9-94mmCGA-wf8p-rqqf-vr4gCGA-wjmg-qmgf-jxrrCGA-wmfp-x674-fqmhCGA-wp62-xcx2-vxwmCGA-wpm6-mv38-c46pCGA-wpw3-m9jm-qv9xCGA-wr99-m98c-vf2mCGA-wv3c-426g-87w7CGA-wv4c-pgrw-95w4CGA-x4r6-jh5c-hm3cCGA-x557-vfgg-mpgwCGA-xgxc-wh4j-hw75CGA-xpj5-8m7r-3m3pCGA-xq7f-h7q4-pvcxCGA-xvmp-4gcv-hhf7
Advisory lineage Upstream: 0 Downstream: 14
Analyzed
Published: 06 Mar 2026, 21:28
Last modified:10 Mar 2026, 13:35
Vulnerability Summary
Overall Risk (default)
low
24/100 CVSS Score
5.9 MEDIUM
v3.1 (cve.org)
EPSS Score
0.35% LOW
0% probability +0.32%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
06 Mar 2026, 21:28
Published
Vulnerability first disclosed
10 Mar 2026, 13:35
Last Modified
Vulnerability information updated
Description
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.
CVSS Metrics
- v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.35%• Percentile: 29%
Techniques & Countermeasures
- CWE-295•Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Affected Systems
- chainguard•amazon-k8s-cni-fips
< 1.21.1-r6
- chainguard•amazon-k8s-cni-init-fips
< 1.21.1-r6
- chainguard•amazon-k8s-cni-init-fips-compat
< 1.21.1-r6
- chainguard•aws-ebs-csi-driver-1.56
< 1.56.0-r3
- chainguard•aws-ebs-csi-driver-fips-1.56
< 1.56.0-r3
- chainguard•aws-load-balancer-controller-fips
< 3.1.0-r1
- chainguard•boringssl-fips-static-2023042800-tools
< 0
- chainguard•boringssl-fips-static-20240407-tools
< 0
- chainguard•cert-manager-acmesolver-fips-1.18
< 1.18.6-r1
- chainguard•cert-manager-acmesolver-fips-1.19
< 1.19.4-r1
- chainguard•cert-manager-cainjector-fips-1.18
< 1.18.6-r1
- chainguard•cert-manager-cainjector-fips-1.19
< 1.19.4-r1
- chainguard•cert-manager-controller-fips-1.18
< 1.18.6-r1
- chainguard•cert-manager-controller-fips-1.19
< 1.19.4-r1
- chainguard•cert-manager-fips-1.18
< 1.18.6-r1
- chainguard•cert-manager-fips-1.19
< 1.19.4-r1
- chainguard•cert-manager-startupapicheck-fips-1.18
< 1.18.6-r1
- chainguard•cert-manager-startupapicheck-fips-1.19
< 1.19.4-r1
- chainguard•cert-manager-webhook-fips-1.18
< 1.18.6-r1
- chainguard•cert-manager-webhook-fips-1.19
< 1.19.4-r1
- chainguard•chainguard-partners-demo
< 0
- chainguard•cluster-autoscaler-fips-1.35
< 1.35.0-r0
- chainguard•dkron
< 4.1.0-r2
- chainguard•dkron-executor-gcppubsub
< 4.1.0-r2
- chainguard•dkron-executor-grpc
< 4.1.0-r2
- chainguard•dkron-executor-kafka
< 4.1.0-r2
- chainguard•dkron-executor-nats
< 4.1.0-r2
- chainguard•dkron-executor-rabbitmq
< 4.1.0-r2
- chainguard•dkron-processor-files
< 4.1.0-r2
- chainguard•dkron-processor-fluent
< 4.1.0-r2
- chainguard•dkron-processor-log
< 4.1.0-r2
- chainguard•dkron-processor-syslog
< 4.1.0-r2
- chainguard•flux-fips-2.8
< 2.8.1-r4
- chainguard•flux-helm-controller
< 1.5.3-r1
- chainguard•flux-image-automation-controller
< 1.1.1-r3
- chainguard•flux-image-reflector-controller
< 1.1.1-r1
- chainguard•flux-notification-controller
< 1.8.2-r1
- chainguard•flux-operator
< 0.45.0-r1
- chainguard•flux-operator-fips
< 0.43.0-r1
- chainguard•flux-operator-mcp
< 0.45.0-r1
- chainguard•flux-operator-mcp-fips
< 0.43.0-r1
- chainguard•flux-source-controller
< 1.8.1-r1
- chainguard•flux-source-watcher
< 2.1.1-r1
- chainguard•gitlab-container-registry-fips-18.7
< 18.7.5-r1
- chainguard•gitlab-container-registry-fips-18.8
< 18.8.5-r1
- chainguard•gitlab-container-registry-fips-18.9
< 18.9.1-r1
- chainguard•gitlab-logger-fips-18.7
< 0
- chainguard•gitlab-logger-fips-18.8
< 0
- chainguard•gitlab-logger-fips-18.9
< 0
- chainguard•gitlab-shell-fips-18.7
< 18.7.5-r1
Showing first 50 affected entries in server-rendered view.
References (8)
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
- https://go.dev/issue/77953
- https://go.dev/cl/752183
- https://pkg.go.dev/vuln/GO-2026-4600
- https://security-tracker.debian.org/tracker/CVE-2026-27138
- https://pkg.go.dev
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27138.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-27138