Certificate Verification Vulnerability in Go Programming Language
CVE-2026-27138

5.9MEDIUM

Key Information:

Vendor: Go Standard Library
Status: Crypto/x509
Vendor: CVE Published:; 6 March 2026

🔔 Create Go Standard Library Vulnerability Alert

What is CVE-2026-27138?

A vulnerability exists in the Go programming language related to certificate verification within TLS connections. When validating X.509 certificate chains, the process may panic if a certificate in the chain contains an empty DNS name while another certificate has excluded name constraints. This issue can lead to program crashes during both direct verification and functions relying on TLS, potentially disrupting services and applications leveraging these certificates.

Affected Version(s)

crypto/x509 1.26.0-0 < 1.26.1

References

https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk

https://go.dev/issue/77953

https://go.dev/cl/752183

CVSS V3.1

Score:

5.9

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Mar 6, 2026
Vulnerability Reserved
Feb 17, 2026

Credit

Jakub Ciolek

CVE-2026-27138 Data

JSON