crypto/x509: Incorrect enforcement of email constraints in crypto/x509

🗓️ 16 Jul 2026 14:35:59Reported by RedHatType

redhat🔗 access.redhat.com👁 19 Views

Golang x509 misapplies multiple email constraints; only the last is used when domains differ.

Reporter	Title	Published	Views	Family All 900
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and IntegrationRuntime & IntegrationServer operands are vulnerable to loss of confidentiality (CVE-2026-27137) and denial of service (CVE-2026-27138)	1 May 202616:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	4 May 202607:40	–	ibm
attackerkb	CVE-2026-27137	6 Mar 202621:28	–	attackerkb
Tenable Nessus	Alibaba Cloud Linux 3 : 0172: osbuild-composer (ALINUX3-SA-2026:0172)	1 Jul 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : delve (ALSA-2026:8842)	20 Apr 202600:00	–	nessus
Tenable Nessus	Rocky Linux 10.1 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource Multiple Vulnerabilities (crlsa-2026_8842)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 10.2 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_19022)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 10.2 [CIQ] Security Update: osbuild-composer / osbuild-composer-core / etc Multiple Vulnerabilities (crlsa-2026_22450)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 10.2 [CIQ] Security Update: image-builder / image-builder-debuginfo / image-builder-debugsource Multiple Vulnerabilities (crlsa-2026_22937)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9.6 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ciqsa-2026_1411)	1 Oct 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9	aarch64	flightctl-agent	1.1.3-1.el9em	flightctl-agent-1.1.3-1.el9em.aarch64.rpm
Red Hat Enterprise Linux	9	ppc64le	flightctl-agent	1.1.3-1.el9em	flightctl-agent-1.1.3-1.el9em.ppc64le.rpm
Red Hat Enterprise Linux	9	s390x	flightctl-agent	1.1.3-1.el9em	flightctl-agent-1.1.3-1.el9em.s390x.rpm
Red Hat Enterprise Linux	9	x86_64	flightctl-agent	1.1.3-1.el9em	flightctl-agent-1.1.3-1.el9em.x86_64.rpm
Red Hat Enterprise Linux	10	aarch64	flightctl-agent	1.1.3-1.el10em	flightctl-agent-1.1.3-1.el10em.aarch64.rpm
Red Hat Enterprise Linux	10	ppc64le	flightctl-agent	1.1.3-1.el10em	flightctl-agent-1.1.3-1.el10em.ppc64le.rpm
Red Hat Enterprise Linux	10	s390x	flightctl-agent	1.1.3-1.el10em	flightctl-agent-1.1.3-1.el10em.s390x.rpm
Red Hat Enterprise Linux	10	x86_64	flightctl-agent	1.1.3-1.el10em	flightctl-agent-1.1.3-1.el10em.x86_64.rpm
Red Hat Enterprise Linux	9	aarch64	flightctl-cli	1.1.3-1.el9em	flightctl-cli-1.1.3-1.el9em.aarch64.rpm
Red Hat Enterprise Linux	9	ppc64le	flightctl-cli	1.1.3-1.el9em	flightctl-cli-1.1.3-1.el9em.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-27137
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/752182
go	www.go.dev/issue/77952
groups	www.groups.google.com/g/golang-announce/c/EdhZqrQ98hk
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-27137
pkg	www.pkg.go.dev/vuln/GO-2026-4599
cve	www.cve.org/CVERecord

03 Oct 2026 16:13Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.5

EPSS0.00687

SSVC

certificate validation email constraints multiple constraints x509 module golang security flaw