VDB
RHSA-2026:57649
RHSA-2026:57649
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | golang-0:1.26.5-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-docs-0:1.26.5-1.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | go-toolset-0:1.26.5-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-bin-0:1.26.5-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | go-toolset-0:1.26.5-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-race-0:1.26.5-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-race-0:1.26.5-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-bin-0:1.26.5-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-race-0:1.26.5-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | go-toolset-0:1.26.5-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-src-0:1.26.5-1.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-0:1.26.5-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | go-toolset-0:1.26.5-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-bin-0:1.26.5-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-bin-0:1.26.5-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-misc-0:1.26.5-1.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-0:1.26.5-1.el9_4.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-race-0:1.26.5-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-0:1.26.5-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
| Red Hat | golang-0:1.26.5-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 0:1.26.5-1.el9_4 |
…and 1 more
Timeline
- Aug 20, 2026 CVE Published
- Oct 14, 2026 CVE Updated
- Oct 14, 2026 Distribution Patch
- Oct 14, 2026 Distribution Patch
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:57649 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467809 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467810 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467811 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467813 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467820 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467822 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467823 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467825 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467826 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484205 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484207 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2498152 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57649.json advisory
- https://access.redhat.com/security/cve/CVE-2026-27137 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445345 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27137 advisory
…and 109 more