VDB
RHSA-2026:76809
RHSA-2026:76809
PUBLISHED
CVSS 8.100000381469727 HIGH
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | grafana-0:9.0.9-13.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 9.0.9-13.el9, 9.0.9-13.el9 |
| Red Hat | grafana-0:9.0.9-13.el9_2.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 9.0.9-13.el9, 9.0.9-13.el9 |
| Red Hat | grafana-debugsource-0:9.0.9-13.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 9.0.9-13.el9, 9.0.9-13.el9 |
| Red Hat | grafana-debuginfo-0:9.0.9-13.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 9.0.9-13.el9, 9.0.9-13.el9 |
| Red Hat | grafana-debuginfo-0:9.0.9-13.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 9.0.9-13.el9, 9.0.9-13.el9 |
| Red Hat | grafana-debugsource-0:9.0.9-13.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 9.0.9-13.el9, 9.0.9-13.el9 |
| Red Hat | grafana-debugsource-0:9.0.9-13.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 9.0.9-13.el9, 9.0.9-13.el9 |
| Red Hat | grafana-0:9.0.9-13.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 9.0.9-13.el9, 9.0.9-13.el9 |
| Red Hat | grafana-0:9.0.9-13.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 9.0.9-13.el9, 9.0.9-13.el9 |
| Red Hat | grafana-debuginfo-0:9.0.9-13.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 9.0.9-13.el9, 9.0.9-13.el9 |
| Red Hat | grafana-0:9.0.9-13.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 9.0.9-13.el9, 9.0.9-13.el9 |
| Red Hat | grafana-debugsource-0:9.0.9-13.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 9.0.9-13.el9, 9.0.9-13.el9 |
| Red Hat | grafana-debuginfo-0:9.0.9-13.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) | 9.0.9-13.el9, 9.0.9-13.el9 |
Timeline
- Oct 6, 2026 CVE Published
- Oct 15, 2026 CVE Updated
- Oct 15, 2026 Distribution Patch
- Oct 15, 2026 Distribution Patch
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
- Oct 15, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:76809 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445345 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456335 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467809 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2467820 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2477246 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2477262 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484204 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515815 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515820 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515827 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515838 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515839 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515840 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76809.json advisory
- https://access.redhat.com/security/cve/CVE-2026-27137 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-27137 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27137 advisory
…and 83 more