{"cve":"CVE-2026-27138","nvd":{"published":"2026-03-06T22:16:00.963","modified":"2026-06-17T10:26:44.093","status":"Analyzed","description":"Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9},"cwes":["CWE-295"],"references":["https://go.dev/cl/752183","https://go.dev/issue/77953","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://pkg.go.dev/vuln/GO-2026-4600"],"products":["golang:go"],"source":"nvd","synced_at":"2026-10-19T22:25:53.701907451+00:00"},"epss":{"cve":"CVE-2026-27138","score":0.00382,"percentile":0.32183,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GO-2026-4600","url":"https://osv.dev/vulnerability/GO-2026-4600","summary":"Panic in name constraint checking for malformed certificates in crypto/x509","modified":"2026-05-15T10:59:23.758905709Z","packages":[{"ecosystem":"Go","name":"stdlib","purl":"pkg:golang/stdlib","ranges":[">=1.26.0-0 <1.26.1"],"fixed":["1.26.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}