p PatchFirst

CVE-2026-27137

CVE-2026-27137 · Incorrect enforcement of email constraints in crypto/x509

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

CVSS 7.5 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • crypto/x509

    Versions
    • ≥ 1.26.0-0, < 1.26.1: Affected (semver)

    Update to 1.26.1

  • golang-1.26 Debian:14

    Versions
    • 1.26.0-1
    • 1.26~rc2-1
    • 1.26~rc3-1
    • 1.26~rc3-2
    Affected ranges
    • ECOSYSTEM: < 1.26.1-1

    Update to 1.26.1-1

  • golang-1.24 Ubuntu:22.04:LTS

    Versions
    • 1.24.4-1ubuntu1~22.04.1
    • 1.24.4-1ubuntu1~22.04.2
    • 1.24.13-2~22.04.1
    • 1.24.13-2~22.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.25 Ubuntu:22.04:LTS

    Versions
    • 1.25.14-1~ubuntu0.22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.26 Ubuntu:22.04:LTS

    Versions
    • 1.26.8-1~ubuntu0.22.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Ubuntu:24.04:LTS

    Versions
    • 1.24.4-1ubuntu1~24.04.1
    • 1.24.4-1ubuntu1~24.04.2
    • 1.24.13-2~24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.25 Ubuntu:24.04:LTS

    Versions
    • 1.25.14-1~ubuntu0.24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.26 Ubuntu:24.04:LTS

    Versions
    • 1.26.8-1~ubuntu0.24.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Ubuntu:25.10

    Versions
    • 1.24.2-1
    • 1.24.2-2
    • 1.24.4-1
    • 1.24.4-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.25 Ubuntu:25.10

    Versions
    • 1.25.0-0ubuntu1
    • 1.25.7-2~25.10.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.26 Ubuntu:26.10

    Versions
    • 1.26.0-1
    • 1.26.2-3
    • 1.26.4-1
    • 1.26.5-1
    • 1.26.6-2
    • 1.26.7-1
    • 1.26.8-1
    • 1.26.8-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Ubuntu:26.04:LTS

    Versions
    • 1.24.4-1ubuntu1
    • 1.24.9-1
    • 1.24.13-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.25 Ubuntu:26.04:LTS

    Versions
    • 1.25.0-0ubuntu1
    • 1.25.7-2
    • 1.25.14-1~ubuntu0.26.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.26 Ubuntu:26.04:LTS

    Versions
    • 1.26~rc3-2
    • 1.26.0-1
    • 1.26.8-1~ubuntu0.26.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →