CVE-2026-27138 Panic in name constraint checking for malformed certificates in crypto/x509

🗓️ 06 Mar 2026 21:28:14Reported by GoogleType

osv

osv🔗 osv.dev👁 1 Views

Panic in name constraint checks during verification when there is an empty domain name and exclusions.

Reporter	Title	Published	Views	Family All 526
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and IntegrationRuntime & IntegrationServer operands are vulnerable to loss of confidentiality (CVE-2026-27137) and denial of service (CVE-2026-27138)	1 May 202616:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	26 May 202606:03	–	ibm
ATTACKERKB	CVE-2026-27138	6 Mar 202621:28	–	attackerkb
AlpineLinux	CVE-2026-27138	6 Mar 202621:28	–	alpinelinux
BDU FSTEC	The vulnerability of the Go programming language, related to errors in the certificate validation process, allows a perpetrator to cause service failures.	27 Mar 202600:00	–	bdu_fstec
CBLMariner	CVE-2026-27138 affecting package golang for versions less than 1.25.8-1	13 Mar 202619:01	–	cbl_mariner
CBLMariner	CVE-2026-27138 affecting package golang for versions less than 1.26.1-1	13 Mar 202619:01	–	cbl_mariner
Chainguard	CVE-2026-27138 vulnerabilities	10 Mar 202619:18	–	cgr
Circl	CVE-2026-27138	6 Mar 202601:19	–	circl
CNNVD	Google Go 安全漏洞	6 Mar 202600:00	–	cnnvd

Source	Link
go	www.go.dev/cl/752183
go	www.go.dev/issue/77953
groups	www.groups.google.com/g/golang-announce/c/EdhZqrQ98hk
pkg	www.pkg.go.dev/
pkg	www.pkg.go.dev/vuln/GO-2026-4600
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27138.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-27138

15 Jul 2026 01:49Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.15.9

EPSS0.0035

name constraints certificate verification empty domain name excluded constraints