CVE-2026-27138: medium-severity vulnerability in Go standard library crypto/x509
Panic in name constraint checking for malformed certificates in crypto/x509
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.4%
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Go standard library · crypto/x509Related CVEs — Go standard library crypto/x509
In the same product, most dangerous first.
CVE-2024-24783MEDIUMVerify panics on certificates with an unknown public key algorithm in crypto/x509EPSS 0.7%CVE-2026-27137HIGHIncorrect enforcement of email constraints in crypto/x509EPSS 0.7%CVE-2026-32280HIGHUnexpected work during chain building in crypto/x509EPSS 0.6%CVE-2025-22865HIGHParsePKCS1PrivateKey panic with partial keys in crypto/x509EPSS 0.6%CVE-2026-27145MEDIUMInefficient candidate hostname parsing in crypto/x509EPSS 0.6%CVE-2024-45341MEDIUMUsage of IPv6 zone IDs can bypass URI name constraints in crypto/x509EPSS 0.6%