CVE-2026-27138: Panic in name constraint checking for malformed certificates in crypto/x509
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.
Other sources
Panic in name constraint checking for malformed certificates in crypto/x509
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27138?
CVE-2026-27138 has a high severity as it can lead to program crashes during X.509 certificate verification.
How do I fix CVE-2026-27138?
To fix CVE-2026-27138, update to the latest version of the golang/x509 library that resolves the panic issue.
Which versions of the golang/x509 are affected by CVE-2026-27138?
CVE-2026-27138 affects specific versions of golang/x509 that include faulty name constraint checks.
What will happen if I ignore CVE-2026-27138?
Ignoring CVE-2026-27138 may result in application crashes when handling malformed X.509 certificates.
Are all applications using golang/x509 vulnerable to CVE-2026-27138?
Not all applications are vulnerable, but those that utilize affected versions without proper constraints may be at risk.