CVE-2026-27137

HighCVSS 7.5/10Last modified Sep 16, 2026

Description

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-295

Affected software

VendorProductVersions
Go standard librarycrypto/x509>= 1.26.0-0, < 1.26.1
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat OpenStack Platform 16.2—
Red HatRed Hat OpenStack Platform 16.2—
Red HatRed Hat OpenStack Platform 17.1 for RHEL 9—
Red HatRed Hat OpenStack Services on OpenShift 18.0—
Red HatRHEM 1.0 for RHEL 9—
Red HatRHEM 1.1 for RHEL 10—
Red HatRHEM 1.1 for RHEL 9—
Red HatBuilds for Red Hat OpenShift 1.6.0—
Red HatDevWorkspace Operator 0.4—
Red HatLogging for Red Hat OpenShift 6—
Red HatLogging for Red Hat OpenShift 6.2—
Red HatLogging Subsystem for Red Hat OpenShift 6.4—
Red HatMulticluster Global Hub 1.3.4—
Red HatMulticluster Global Hub 1.4.5—
Red HatMulticluster Global Hub 1.6.5—
Red HatOpenShift API for Data Protection 1.4—
Red HatOpenShift API for Data Protection 1.5—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15—
Red HatRed Hat Ansible Automation Platform 2.6—
Red HatRed Hat Hardened Images—
Red HatRed Hat Lightspeed (formerly Insights) for Runtimes 1.0—
Red HatRed Hat Migration Toolkit 1.8—
Red HatRed Hat multicluster global hub 1.5.3—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift Builds 1.7.3—
Red HatRed Hat OpenShift Dev Spaces 3.27—
Red HatRed Hat OpenShift distributed tracing 3.9.3—

References

Timeline

Published
Mar 6, 2026
Last modified
Sep 16, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-271385.9Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded nCVE-2026-271392.5On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file CVE-2026-27144.4The Institute Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Enquiry Form Title' setting in all versiCVE-2026-271408.8SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trCVE-2026-271417.5Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panicCVE-2026-271426.1Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-CVE-2026-271439.8Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow forCVE-2026-271447.1The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from mCVE-2026-271456.5(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This causCVE-2026-271464.5GetSimple CMS is a content management system. All versions of GetSimple CMS do not implement CSRF protection on the administrative file uploCVE-2026-271475.4GetSimple CMS is a content management system. All versions of GetSimple CMS are vulnerable to XSS through SVG file uploads. Authenticated usCVE-2026-271489.6Storybook is a frontend workshop for building user interface components and pages in isolation. Prior to versions 7.6.23, 8.6.17, 9.1.19, an
CVE-2026-27137: High severity, CVSS 7.5 | Vulnix