Incorrect enforcement of email constraints in crypto/x509
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-27137US | — | — | ||
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2026:10125WEB
- https://access.redhat.com/errata/RHSA-2026:10158WEB
- https://access.redhat.com/errata/RHSA-2026:10169WEB
- https://access.redhat.com/errata/RHSA-2026:10175WEB
- https://access.redhat.com/errata/RHSA-2026:10184WEB
- https://access.redhat.com/errata/RHSA-2026:10225WEB
- https://access.redhat.com/errata/RHSA-2026:10250WEB
- https://access.redhat.com/errata/RHSA-2026:10929WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan