Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligenceCVE-2026-27138

CVE-2026-27138

MEDIUM5.9

Panic in name constraint checking for malformed certificates in crypto/x509

Published Mar 6, 2026

Modified 1 months ago

Details

Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.

References

https://go.dev/cl/752183

https://go.dev/issue/77953

https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk

https://pkg.go.dev/vuln/GO-2026-4600

https://www.cve.org/CVERecord?id=CVE-2026-27138

CVSS Analysis

CVSS v3.1

5.9

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

5.9/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Ecosystems

Timeline

PublishedMar 6, 2026

ModifiedMar 10, 2026

CVE-2026-27138 | Mondoo Vulnerability Intelligence