# CVE-2026-27137

## Summary

- **CVE ID:** CVE-2026-27137
- **Severity:** HIGH
- **CVSS Score:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** N/A
- **Published:** Mar 6, 2026
- **Last Modified:** Sep 17, 2026

## Description

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

## Affected Products

- Go standard library — crypto/x509 (1.26.0-0)

## References

- [CNA](https://go.dev/cl/752182)
- [CNA](https://go.dev/issue/77952)
- [CNA](https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk)
- [CNA](https://pkg.go.dev/vuln/GO-2026-4599)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2026-27137)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2445345)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27137.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28047)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10929)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8842)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10169)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19022)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22937)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19049)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22450)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19132)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28038)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19181)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23228)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22714)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:9872)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26585)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:11800)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22862)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22423)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22347)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:5110)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21769)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23345)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:29854)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26568)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8151)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:13545)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7291)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:9052)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10184)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:5549)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10158)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10175)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:9697)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:9698)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:9699)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:9385)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19375)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:14879)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10125)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10250)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10225)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8338)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8337)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8167)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36796)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:39810)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41019)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41928)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54757)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:49703)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:49702)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56143)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:57649)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:49712)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56223)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:61253)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:67160)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:67159)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:67517)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:67518)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.61%
- **EPSS Percentile:** 47.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._