VulnerabilityAnalyzed
CVE-2026-27138
This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.
MEDIUM 5.9EPSS 0.35%
Does this matter?
Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own.
Description
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.35% probability · 28th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-295
- Affected
- golang/go
- Source
- security@golang.org
References
- https://go.dev/cl/752183Mailing List
- https://go.dev/issue/77953Issue Tracking
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hkRelease Notes
- https://pkg.go.dev/vuln/GO-2026-4600Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.