Platform
go
Component
stdlib
Fixed in
1.26.1
1.26.1
CVE-2026-27137 describes a certificate validation vulnerability within the Go standard library (stdlib). This flaw allows attackers to bypass validation checks by exploiting how email address constraints within certificates are handled. Affected versions are those prior to 1.26.1; upgrading to this version resolves the issue. The vulnerability stems from improper handling of multiple email address constraints sharing common local portions but differing domain portions.
The core impact of CVE-2026-27137 lies in the potential for man-in-the-middle (MITM) attacks. An attacker can craft a malicious certificate chain where the email address constraints are designed to bypass validation. This allows the attacker to impersonate a legitimate server, intercepting and potentially modifying traffic between a client and the intended server. The blast radius is significant, impacting any application relying on Go's certificate validation routines for secure communication, such as TLS connections. This could affect web servers, API clients, and any other service utilizing certificate-based authentication.
CVE-2026-27137 was publicly disclosed on 2026-03-06. There are currently no publicly available proof-of-concept exploits. The EPSS score is pending evaluation. It's crucial to prioritize patching due to the potential for MITM attacks and the relative ease of crafting malicious certificates.
Exploit Status
EPSS
0.01% (2% percentile)
The primary mitigation for CVE-2026-27137 is to upgrade to Go version 1.26.1 or later. This version includes a fix that correctly handles email address constraints during certificate chain validation. If upgrading is not immediately feasible, consider implementing stricter certificate pinning policies within your applications to limit the certificates that are trusted. While not a direct fix, this can reduce the attack surface. Thoroughly review your application's certificate validation logic to ensure it adheres to best practices and doesn't rely on potentially flawed assumptions.
Update the crypto/x509 library to version 1.26.1 or later. This will correct the incorrect validation of email constraints in X.509 certificates.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-27137 is a vulnerability in the Go standard library where certificate validation fails when handling multiple email address constraints, potentially allowing MITM attacks.
You are affected if you are using Go versions prior to 1.26.1 and rely on the standard library's certificate validation routines for secure communication.
Upgrade to Go version 1.26.1 or later to resolve the vulnerability. Consider implementing certificate pinning as an additional security measure.
As of now, there are no publicly known active exploits for CVE-2026-27137, but it's crucial to patch proactively.
Refer to the official Go security advisory for detailed information and updates: [https://go.dev/security](https://go.dev/security)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your go.mod file and we'll tell you instantly if you're affected.