Certificate Verification Flaw in Go's Cryptography Module

CVE-2026-27137

What is CVE-2026-27137?

A flaw in the certificate verification process of Go's cryptography module has been identified, where it fails to properly apply multiple email address constraints in a certificate chain. When dealing with certificates that have local portions that are identical yet differ in their domain portions, only the last specified constraint is acknowledged. This vulnerability could potentially lead to misconfigured security policies, allowing unintended access or verification issues, thus posing a risk to applications reliant on accurate certificate validation.

References