GO-2026-4600

vendorUSosv

Panic in name constraint checking for malformed certificates in crypto/x509

view advisory published 2026-03-06Licence: per source

Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-27138US	—	0.33% (25th)	—	2026-03-06
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/752183FIX
https://go.dev/issue/77953REPORT
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hkWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan