CVE-2026-27138

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27138
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-27138.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-27138
Aliases
Downstream
Related
Published
2026-03-06T21:28:14Z
Modified
2026-05-15T04:14:30.826541324Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Panic in name constraint checking for malformed certificates in crypto/x509
Details

Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27138.json",
    "cna_assigner": "Go",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.26.0-0"
                },
                {
                    "fixed": "1.26.1"
                }
            ]
        }
    ]
}
References

Affected packages