CVE-2026-27138

Summary

Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.

Impact & exploitability

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products we track (1)

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

• NVD record
• https://pkg.go.dev/vuln/GO-2026-4600Advisory
• https://go.dev/cl/752183
• https://go.dev/issue/77953
• https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk