PatchRadar

← Browse

CVE-2026-27137

Medium

Elevated severity or exploit probability.

CVSS base
7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS — probability of exploitation (30 days)
0.6%
47.6th percentile
CISA KEV
Not listed
Weakness / dates
CWE-295
Published 2026-03-06 · modified 2026-09-16

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNNetwork
Attack ComplexityLLow
Privileges RequiredNNone
User InteractionNNone
ScopeUUnchanged
ConfidentialityNNone
IntegrityNNone
AvailabilityHHigh

Timeline

Description

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

Affected

golang

References

Official: NVD · CVE.org