CVE-2026-27138
CVE-2026-27138 · Panic in name constraint checking for malformed certificates in crypto/x509
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.
CVSS 5.9 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
crypto/x509
- Versions
- ≥ 1.26.0-0, < 1.26.1: Affected (semver)
Update to 1.26.1
golang-1.26 Debian:14
- Versions
- 1.26.0-1
- 1.26~rc2-1
- 1.26~rc3-1
- 1.26~rc3-2
- Affected ranges
- ECOSYSTEM: < 1.26.1-1
Update to 1.26.1-1
golang-1.24 Ubuntu:22.04:LTS
- Versions
- 1.24.4-1ubuntu1~22.04.1
- 1.24.4-1ubuntu1~22.04.2
- 1.24.13-2~22.04.1
- 1.24.13-2~22.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.25 Ubuntu:22.04:LTS
- Versions
- 1.25.14-1~ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.26 Ubuntu:22.04:LTS
- Versions
- 1.26.8-1~ubuntu0.22.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Ubuntu:24.04:LTS
- Versions
- 1.24.4-1ubuntu1~24.04.1
- 1.24.4-1ubuntu1~24.04.2
- 1.24.13-2~24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.25 Ubuntu:24.04:LTS
- Versions
- 1.25.14-1~ubuntu0.24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.26 Ubuntu:24.04:LTS
- Versions
- 1.26.8-1~ubuntu0.24.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Ubuntu:25.10
- Versions
- 1.24.2-1
- 1.24.2-2
- 1.24.4-1
- 1.24.4-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.25 Ubuntu:25.10
- Versions
- 1.25.0-0ubuntu1
- 1.25.7-2~25.10.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.26 Ubuntu:26.10
- Versions
- 1.26.0-1
- 1.26.2-3
- 1.26.4-1
- 1.26.5-1
- 1.26.6-2
- 1.26.7-1
- 1.26.8-1
- 1.26.8-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Ubuntu:26.04:LTS
- Versions
- 1.24.4-1ubuntu1
- 1.24.9-1
- 1.24.13-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.25 Ubuntu:26.04:LTS
- Versions
- 1.25.0-0ubuntu1
- 1.25.7-2
- 1.25.14-1~ubuntu0.26.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.26 Ubuntu:26.04:LTS
- Versions
- 1.26~rc3-2
- 1.26.0-1
- 1.26.8-1~ubuntu0.26.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published