VDB
RHSA-2026%3A9699
RHSA-2026%3A9699
PUBLISHED
CVSS 7.5 HIGH
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:247a54db35e184702d9c1d6f83cd9e3669f8aae48bd0eeaecdbeeda6176c525f_amd64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:247a54db35e184702d9c1d6f83cd9e3669f8aae48bd0eeaecdbeeda6176c525f_amd64, *, registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:247a54db35e184702d9c1d6f83cd9e3669f8aae48bd0eeaecdbeeda6176c525f_amd64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:627f071531fb4da783c4f231fa3afd26d9eb9a56dc51b5d55a742f167b36d2f9_ppc64le as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:46c6c393d217df1c645c06d0da7ac1e82defc4ee1d773b6e288c976cdfaf1f89_ppc64le as a component of Red Hat OpenShift GitOps 1.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:81de8e9723ec5819ecf40a8abac1218d3ca23f65db824996e697c3f5eb1c88ce_ppc64le as a component of Red Hat OpenShift GitOps 1.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:fde967c5f4e625ad901ff3635f7a9cd0e9db64dfff9083618e3d793e21e8488f_amd64 as a component of Red Hat OpenShift GitOps 1.2 | *, *, registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:fde967c5f4e625ad901ff3635f7a9cd0e9db64dfff9083618e3d793e21e8488f_amd64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:a87ae94bb4eeaf8e00e5b60639ce8a74af2fa74d5312f1586db65ac2e7e3915e_arm64 as a component of Red Hat OpenShift GitOps 1.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:9bbdc7456e80ff7adc21ee179f2ad678131b700a30f467e9cae98f52fcc1a866_arm64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:9bbdc7456e80ff7adc21ee179f2ad678131b700a30f467e9cae98f52fcc1a866_arm64, *, registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:9bbdc7456e80ff7adc21ee179f2ad678131b700a30f467e9cae98f52fcc1a866_arm64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:8b19c499ebb9feeb664ff3721bdc2170fd62a21cc9f5c84d9ff10cd0a71030e7_ppc64le as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:8b19c499ebb9feeb664ff3721bdc2170fd62a21cc9f5c84d9ff10cd0a71030e7_ppc64le, registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:8b19c499ebb9feeb664ff3721bdc2170fd62a21cc9f5c84d9ff10cd0a71030e7_ppc64le |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:ddd9d15f0962e166d5e2ca0797137a135f34c558a5a51ac85a173f245d763625_amd64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:f3b25a4b791a6d75c2bb7fa156fa5796ca0ef7e3520c432cd1e0ee094b0b44ca_arm64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:f3b25a4b791a6d75c2bb7fa156fa5796ca0ef7e3520c432cd1e0ee094b0b44ca_arm64, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:f3b25a4b791a6d75c2bb7fa156fa5796ca0ef7e3520c432cd1e0ee094b0b44ca_arm64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a8c1669907826bf3f711845c6d4833b2e2c5c4807bada9797b9b0d6397955b7_arm64 as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a8c1669907826bf3f711845c6d4833b2e2c5c4807bada9797b9b0d6397955b7_arm64, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:1bbc1efa6478d85935146b7c50217204094e0c07a3d096f353567cc4aec7b7af_amd64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:ddd9d15f0962e166d5e2ca0797137a135f34c558a5a51ac85a173f245d763625_amd64 as a component of Red Hat OpenShift GitOps 1.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:96b8cc9a32104c7262aabc79dc01489640378717cd75d33c0aaca165ff193b2e_s390x as a component of Red Hat OpenShift GitOps 1.2 | *, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:96b8cc9a32104c7262aabc79dc01489640378717cd75d33c0aaca165ff193b2e_s390x, * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:96b8cc9a32104c7262aabc79dc01489640378717cd75d33c0aaca165ff193b2e_s390x as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:96b8cc9a32104c7262aabc79dc01489640378717cd75d33c0aaca165ff193b2e_s390x, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:96b8cc9a32104c7262aabc79dc01489640378717cd75d33c0aaca165ff193b2e_s390x |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:b406493693fdae121f128e9a18b4139a05f5e682fd8dacfa3e8fe7c6b35bcfbd_arm64 as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:b406493693fdae121f128e9a18b4139a05f5e682fd8dacfa3e8fe7c6b35bcfbd_arm64, registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:b406493693fdae121f128e9a18b4139a05f5e682fd8dacfa3e8fe7c6b35bcfbd_arm64 |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:122e412e01acd1a6a67b07364e280545b356488de9e1874cbff0a2a72a958525_s390x as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:a6596a7bcceb01a55db1f2ad9894ec8550cf4a6d9fc5976d9082684863f0ff8d_amd64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:a3996e99a9ebe783373b78f352e5c77970e66546e888bce3bc9a02594bd37ad3_ppc64le as a component of Red Hat OpenShift GitOps 1.2 | registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:a3996e99a9ebe783373b78f352e5c77970e66546e888bce3bc9a02594bd37ad3_ppc64le, * |
…and 106 more
Timeline
- Apr 22, 2026 CVE Published
- Aug 12, 2026 CVE Updated
- Aug 12, 2026 Distribution Patch
- Aug 12, 2026 Distribution Patch
- Aug 12, 2026 Security Advisory
- Aug 12, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:9699 advisory
- https://access.redhat.com/security/cve/CVE-2026-27137 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_gitops/1.20/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9699.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445345 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27137 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27137 advisory
- https://go.dev/cl/752182 advisory
- https://go.dev/issue/77952 advisory
- https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk advisory
- https://pkg.go.dev/vuln/GO-2026-4599 advisory