Certificate Verification Vulnerability in Go Programming Language
CVE-2026-27138

5.9MEDIUM

Key Information:

Vendor: Go Standard Library
Status: Crypto/x509
Vendor: CVE Published:; 6 March 2026

🔔 Create Go Standard Library Vulnerability Alert

What is CVE-2026-27138?

A vulnerability exists in the Go programming language related to certificate verification within TLS connections. When validating X.509 certificate chains, the process may panic if a certificate in the chain contains an empty DNS name while another certificate has excluded name constraints. This issue can lead to program crashes during both direct verification and functions relying on TLS, potentially disrupting services and applications leveraging these certificates.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

crypto/x509 1.26.0-0 < 1.26.1

References

https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk

https://go.dev/issue/77953

https://go.dev/cl/752183

CVSS V3.1

Score:

5.9

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Mar 6, 2026
Vulnerability Reserved
Feb 17, 2026

Credit

Jakub Ciolek

JSON

Go Standard Library

What is CVE-2026-27138?

Human OS v1.0: Ageing Is an Unpatched Zero-Day Vulnerability.

Affected Version(s)

References

CVSS V3.1

Timeline

Credit

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.