crypto/x509: Incorrect enforcement of email constraints in crypto/x509

🗓️ 09 Apr 2026 11:00:43Reported by RedHatType

Golang crypto/x509 incorrectly enforces multiple email constraints with same local part but different domains; only the last constraint is applied.

Reporter	Title	Published	Views	Family All 648
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and IntegrationRuntime & IntegrationServer operands are vulnerable to loss of confidentiality (CVE-2026-27137) and denial of service (CVE-2026-27138)	1 May 202616:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	4 May 202607:40	–	ibm
ATTACKERKB	CVE-2026-27137	6 Mar 202621:28	–	attackerkb
Tenable Nessus	Alibaba Cloud Linux 3 : 0172: osbuild-composer (ALINUX3-SA-2026:0172)	1 Jul 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : delve (ALSA-2026:8842)	20 Apr 202600:00	–	nessus
Tenable Nessus	Golang 1.26.x < 1.26.1 Multiple Vulnerabilities	6 Mar 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : go1.26 (openSUSE-SU-2026:20342-1)	13 Mar 202600:00	–	nessus
Tenable Nessus	Oracle Linux 10 : image-builder (ELSA-2026-13642)	7 May 202600:00	–	nessus
Tenable Nessus	Oracle Linux 9 : image-builder (ELSA-2026-13671)	7 May 202600:00	–	nessus
Tenable Nessus	Oracle Linux 10 : golang (ELSA-2026-19022)	15 Jul 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	golang1.26	1.26.2-1.hum1	golang1.26-1.26.2-1.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	golang1.26	1.26.2-1.hum1	golang1.26-1.26.2-1.hum1.x86_64.rpm
Red Hat Hardened Images	any	noarch	golang1.26-docs	1.26.2-1.hum1	golang1.26-docs-1.26.2-1.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-27137
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/752182
go	www.go.dev/issue/77952
groups	www.groups.google.com/g/golang-announce/c/EdhZqrQ98hk
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-27137
pkg	www.pkg.go.dev/vuln/GO-2026-4599
cve	www.cve.org/CVERecord

21 Jul 2026 13:32Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.17.5

EPSS0.00606

SSVC