CVE-2026-27138
Panic in name constraint checking for malformed certificates in crypto/x509
5.9
MEDIUM
CVSS 3.1
EPSS 0.03%
Description
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.
How to fix CVE-2026-27138
To remediate CVE-2026-27138, upgrade the affected package to a fixed version below.
- —upgrade to 1.26.1 or later
- —upgrade to 1.26.1-1 or later
- —upgrade to 1.26.1 or later
Is CVE-2026-27138 being exploited?
Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.
Affected packages (3)
- >= 1.26.0-0, < 1.26.1
- from 0, < 1.26.1-1
- >= 1.26.0-0, < 1.26.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |