CVE-2026-27137

Incorrect enforcement of email constraints in crypto/x509

Published Mar 6, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:10125 cve-icon
https://access.redhat.com/errata/RHSA-2026:10158 cve-icon
https://access.redhat.com/errata/RHSA-2026:10169 cve-icon
https://access.redhat.com/errata/RHSA-2026:10175 cve-icon
https://access.redhat.com/errata/RHSA-2026:10184 cve-icon
https://access.redhat.com/errata/RHSA-2026:10225 cve-icon
https://access.redhat.com/errata/RHSA-2026:10250 cve-icon
https://access.redhat.com/errata/RHSA-2026:10929 cve-icon
https://access.redhat.com/errata/RHSA-2026:11800 cve-icon
https://access.redhat.com/errata/RHSA-2026:13545 cve-icon
https://access.redhat.com/errata/RHSA-2026:14879 cve-icon
https://access.redhat.com/errata/RHSA-2026:19022 cve-icon
https://access.redhat.com/errata/RHSA-2026:19049 cve-icon
https://access.redhat.com/errata/RHSA-2026:19132 cve-icon
https://access.redhat.com/errata/RHSA-2026:19181 cve-icon
https://access.redhat.com/errata/RHSA-2026:19375 cve-icon
https://access.redhat.com/errata/RHSA-2026:21769 cve-icon
https://access.redhat.com/errata/RHSA-2026:22347 cve-icon
https://access.redhat.com/errata/RHSA-2026:22423 cve-icon
https://access.redhat.com/errata/RHSA-2026:22450 cve-icon
https://access.redhat.com/errata/RHSA-2026:22714 cve-icon
https://access.redhat.com/errata/RHSA-2026:22862 cve-icon
https://access.redhat.com/errata/RHSA-2026:22937 cve-icon
https://access.redhat.com/errata/RHSA-2026:23228 cve-icon
https://access.redhat.com/errata/RHSA-2026:23345 cve-icon
https://access.redhat.com/errata/RHSA-2026:26568 cve-icon
https://access.redhat.com/errata/RHSA-2026:26585 cve-icon
https://access.redhat.com/errata/RHSA-2026:28038 cve-icon
https://access.redhat.com/errata/RHSA-2026:28047 cve-icon
https://access.redhat.com/errata/RHSA-2026:29854 cve-icon
https://access.redhat.com/errata/RHSA-2026:36796 cve-icon
https://access.redhat.com/errata/RHSA-2026:39810 cve-icon
https://access.redhat.com/errata/RHSA-2026:41019 cve-icon
https://access.redhat.com/errata/RHSA-2026:41928 cve-icon
https://access.redhat.com/errata/RHSA-2026:49702 cve-icon
https://access.redhat.com/errata/RHSA-2026:49703 cve-icon
https://access.redhat.com/errata/RHSA-2026:49712 cve-icon
https://access.redhat.com/errata/RHSA-2026:5110 cve-icon
https://access.redhat.com/errata/RHSA-2026:54757 cve-icon
https://access.redhat.com/errata/RHSA-2026:5549 cve-icon
https://access.redhat.com/errata/RHSA-2026:56143 cve-icon
https://access.redhat.com/errata/RHSA-2026:56223 cve-icon
https://access.redhat.com/errata/RHSA-2026:57649 cve-icon
https://access.redhat.com/errata/RHSA-2026:61253 cve-icon
https://access.redhat.com/errata/RHSA-2026:67159 cve-icon
https://access.redhat.com/errata/RHSA-2026:67160 cve-icon
https://access.redhat.com/errata/RHSA-2026:67517 cve-icon
https://access.redhat.com/errata/RHSA-2026:67518 cve-icon
https://access.redhat.com/errata/RHSA-2026:7291 cve-icon
https://access.redhat.com/errata/RHSA-2026:8151 cve-icon
https://access.redhat.com/errata/RHSA-2026:8167 cve-icon
https://access.redhat.com/errata/RHSA-2026:8337 cve-icon
https://access.redhat.com/errata/RHSA-2026:8338 cve-icon
https://access.redhat.com/errata/RHSA-2026:8842 cve-icon
https://access.redhat.com/errata/RHSA-2026:9052 cve-icon
https://access.redhat.com/errata/RHSA-2026:9385 cve-icon
https://access.redhat.com/errata/RHSA-2026:9697 cve-icon
https://access.redhat.com/errata/RHSA-2026:9698 cve-icon
https://access.redhat.com/errata/RHSA-2026:9699 cve-icon
https://access.redhat.com/errata/RHSA-2026:9872 cve-icon
https://access.redhat.com/security/cve/CVE-2026-27137 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2445345 cve-icon
https://go.dev/cl/752182 cve-icon cve-icon cve-icon
https://go.dev/issue/77952 cve-icon cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-27137 cve-icon
https://pkg.go.dev/vuln/GO-2026-4599 cve-icon cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27137.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-27137 cve-icon
History
Type Values Removed Values Added
First Time appeared Golang
Golang go
CPEs cpe:2.3:a:golang:go:1.26.0:*:*:*:*:*:*:*
Vendors & Products Golang
Golang go
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Go Standard Library
Go Standard Library crypto Tls
Vendors & Products Go Standard Library
Go Standard Library crypto Tls
Type Values Removed Values Added
Description When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
Title Incorrect enforcement of email constraints in crypto/x509
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Sep 18, 2026, 12:04 PM
Reserved
Feb 17, 2026, 7:57 PM
Status
Modified
Published
Mar 6, 2026, 10:16 PM
Modified
Sep 16, 2026, 1:17 PM
Severity
Moderate
Public date
Mar 6, 2026, 9:28 PM