VDB
RHSA-2026:49702
RHSA-2026:49702
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | golang-0:1.26.5-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-misc-0:1.26.5-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | go-toolset-0:1.26.5-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | go-toolset-0:1.26.5-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-0:1.26.5-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-race-0:1.26.5-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | go-toolset-0:1.26.5-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-bin-0:1.26.5-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-race-0:1.26.5-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-bin-0:1.26.5-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | go-toolset-0:1.26.5-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-race-0:1.26.5-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-src-0:1.26.5-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-bin-0:1.26.5-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-bin-0:1.26.5-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-0:1.26.5-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-0:1.26.5-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-tests-0:1.26.5-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-0:1.26.5-1.el10_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
| Red Hat | golang-docs-0:1.26.5-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) | 0:1.26.5-1.el10_0 |
…and 1 more
Timeline
- Aug 3, 2026 CVE Published
- Aug 30, 2026 CVE Updated
- Aug 30, 2026 Distribution Patch
- Aug 30, 2026 Distribution Patch
- Aug 30, 2026 Security Advisory
- Aug 30, 2026 Security Advisory
- Aug 30, 2026 Security Advisory
- Aug 30, 2026 Security Advisory
- Aug 30, 2026 Security Advisory
- Aug 30, 2026 Security Advisory
- Aug 30, 2026 Security Advisory
- Aug 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:49702 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467809 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467810 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467811 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467813 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467820 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467822 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467823 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467825 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467826 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484205 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484207 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2498152 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49702.json advisory
- https://access.redhat.com/security/cve/CVE-2026-27137 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445345 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27137 advisory
…and 102 more