> CVE-2026-27138

« BACK_TO_HOME
PUBLISHED
2026-03-06 22:16
MODIFIED
2026-03-06 22:16
EPSS (Prob. Exploit)
0.38%
Top 67.6%
DATA SOURCES:
NVD 🔗 2026-03-06 FIRST EPSS 🔗 2026-11-08 OSV 🔗 2026-11-08 MSRC 🔗 2026-11-02

> DESCRIPTION

Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Neuron)
Red Hat AI Base Images 3.5.5 (Neuron) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Neuron)
Red Hat AI Base Images 3.4.6 (Neuron) is now available.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Panic in name constraint checking for malformed certificates in crypto/x509

AFFECTED PACKAGES:
Unknown / Unknown
2 versions affected
ALIASES:
BIT-golang-2026-27138, GO-2026-4600

> HISTORIQUE DES MODIFICATIONS

Première apparition
06/03/2026 22:16
Source: NVD
Total des modifications: 0 Dernière mise à jour: 8 months ago

> REFERENCES

https://go.dev/cl/752183
https://go.dev/issue/77953
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
https://pkg.go.dev/vuln/GO-2026-4600
« BACK_TO_HOME