VDB
RHSA-2026%3A9699
RHSA-2026%3A9699
PUBLISHED
CVSS 7.5 HIGH
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:247a54db35e184702d9c1d6f83cd9e3669f8aae48bd0eeaecdbeeda6176c525f_amd64 as a component of Red Hat OpenShift GitOps 1.2 | *, *, registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:247a54db35e184702d9c1d6f83cd9e3669f8aae48bd0eeaecdbeeda6176c525f_amd64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:46c6c393d217df1c645c06d0da7ac1e82defc4ee1d773b6e288c976cdfaf1f89_ppc64le as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:46c6c393d217df1c645c06d0da7ac1e82defc4ee1d773b6e288c976cdfaf1f89_ppc64le, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:46c6c393d217df1c645c06d0da7ac1e82defc4ee1d773b6e288c976cdfaf1f89_ppc64le |
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:81de8e9723ec5819ecf40a8abac1218d3ca23f65db824996e697c3f5eb1c88ce_ppc64le as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:81de8e9723ec5819ecf40a8abac1218d3ca23f65db824996e697c3f5eb1c88ce_ppc64le, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:fde967c5f4e625ad901ff3635f7a9cd0e9db64dfff9083618e3d793e21e8488f_amd64 as a component of Red Hat OpenShift GitOps 1.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:a87ae94bb4eeaf8e00e5b60639ce8a74af2fa74d5312f1586db65ac2e7e3915e_arm64 as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:a87ae94bb4eeaf8e00e5b60639ce8a74af2fa74d5312f1586db65ac2e7e3915e_arm64, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:a87ae94bb4eeaf8e00e5b60639ce8a74af2fa74d5312f1586db65ac2e7e3915e_arm64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:9bbdc7456e80ff7adc21ee179f2ad678131b700a30f467e9cae98f52fcc1a866_arm64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:9bbdc7456e80ff7adc21ee179f2ad678131b700a30f467e9cae98f52fcc1a866_arm64, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:8b19c499ebb9feeb664ff3721bdc2170fd62a21cc9f5c84d9ff10cd0a71030e7_ppc64le as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:8b19c499ebb9feeb664ff3721bdc2170fd62a21cc9f5c84d9ff10cd0a71030e7_ppc64le, registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:8b19c499ebb9feeb664ff3721bdc2170fd62a21cc9f5c84d9ff10cd0a71030e7_ppc64le, registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:8b19c499ebb9feeb664ff3721bdc2170fd62a21cc9f5c84d9ff10cd0a71030e7_ppc64le |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:f3b25a4b791a6d75c2bb7fa156fa5796ca0ef7e3520c432cd1e0ee094b0b44ca_arm64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:f3b25a4b791a6d75c2bb7fa156fa5796ca0ef7e3520c432cd1e0ee094b0b44ca_arm64, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:f3b25a4b791a6d75c2bb7fa156fa5796ca0ef7e3520c432cd1e0ee094b0b44ca_arm64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a8c1669907826bf3f711845c6d4833b2e2c5c4807bada9797b9b0d6397955b7_arm64 as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a8c1669907826bf3f711845c6d4833b2e2c5c4807bada9797b9b0d6397955b7_arm64, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:ddd9d15f0962e166d5e2ca0797137a135f34c558a5a51ac85a173f245d763625_amd64 as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:ddd9d15f0962e166d5e2ca0797137a135f34c558a5a51ac85a173f245d763625_amd64, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:96b8cc9a32104c7262aabc79dc01489640378717cd75d33c0aaca165ff193b2e_s390x as a component of Red Hat OpenShift GitOps 1.2 | *, *, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:96b8cc9a32104c7262aabc79dc01489640378717cd75d33c0aaca165ff193b2e_s390x |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:96b8cc9a32104c7262aabc79dc01489640378717cd75d33c0aaca165ff193b2e_s390x as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:96b8cc9a32104c7262aabc79dc01489640378717cd75d33c0aaca165ff193b2e_s390x, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:96b8cc9a32104c7262aabc79dc01489640378717cd75d33c0aaca165ff193b2e_s390x |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:b406493693fdae121f128e9a18b4139a05f5e682fd8dacfa3e8fe7c6b35bcfbd_arm64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:b406493693fdae121f128e9a18b4139a05f5e682fd8dacfa3e8fe7c6b35bcfbd_arm64, registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:b406493693fdae121f128e9a18b4139a05f5e682fd8dacfa3e8fe7c6b35bcfbd_arm64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:a3996e99a9ebe783373b78f352e5c77970e66546e888bce3bc9a02594bd37ad3_ppc64le as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:a3996e99a9ebe783373b78f352e5c77970e66546e888bce3bc9a02594bd37ad3_ppc64le, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:b7e423bf7fde922a1d8fe4adf6f5205fc4908881f496e6ebd05db0b5f890d35c_amd64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:b7e423bf7fde922a1d8fe4adf6f5205fc4908881f496e6ebd05db0b5f890d35c_amd64, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:b7e423bf7fde922a1d8fe4adf6f5205fc4908881f496e6ebd05db0b5f890d35c_amd64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1f376f53aa7d80bf48b61314480596b4837a9c80a0bbbefb428dc24ad74a6126_amd64 as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1f376f53aa7d80bf48b61314480596b4837a9c80a0bbbefb428dc24ad74a6126_amd64, registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1f376f53aa7d80bf48b61314480596b4837a9c80a0bbbefb428dc24ad74a6126_amd64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1f376f53aa7d80bf48b61314480596b4837a9c80a0bbbefb428dc24ad74a6126_amd64 as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1f376f53aa7d80bf48b61314480596b4837a9c80a0bbbefb428dc24ad74a6126_amd64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:ddd9d15f0962e166d5e2ca0797137a135f34c558a5a51ac85a173f245d763625_amd64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:ddd9d15f0962e166d5e2ca0797137a135f34c558a5a51ac85a173f245d763625_amd64, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:ddd9d15f0962e166d5e2ca0797137a135f34c558a5a51ac85a173f245d763625_amd64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:9933d9dfafd4c1085a58e305b187386b3ea3f751a483c811a81b7f3ffd31c738_s390x as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:9933d9dfafd4c1085a58e305b187386b3ea3f751a483c811a81b7f3ffd31c738_s390x, registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:9933d9dfafd4c1085a58e305b187386b3ea3f751a483c811a81b7f3ffd31c738_s390x |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:a87ae94bb4eeaf8e00e5b60639ce8a74af2fa74d5312f1586db65ac2e7e3915e_arm64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:a87ae94bb4eeaf8e00e5b60639ce8a74af2fa74d5312f1586db65ac2e7e3915e_arm64, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:a87ae94bb4eeaf8e00e5b60639ce8a74af2fa74d5312f1586db65ac2e7e3915e_arm64 |
…and 63 more
Timeline
- Apr 22, 2026 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 19, 2026 CVE Updated
References
- https://go.dev/cl/752182 advisory
- https://go.dev/issue/77952 advisory
- https://access.redhat.com/errata/RHSA-2026:9699 advisory
- https://access.redhat.com/security/cve/CVE-2026-27137 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_gitops/1.20/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9699.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445345 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27137 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27137 advisory
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk advisory
- https://pkg.go.dev/vuln/GO-2026-4599 advisory