CVE-2026-27137

Name	CVE-2026-27137
Description	When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-1.15 (PTS)	bullseye	1.15.15-1~deb11u4	fixed
golang-1.19 (PTS)	bookworm	1.19.8-2	fixed
golang-1.24 (PTS)	trixie	1.24.4-1	fixed
	forky, sid	1.24.13-2	fixed
golang-1.25 (PTS)	forky, sid	1.25.8-1	fixed
golang-1.26 (PTS)	forky, sid	1.26.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
golang-1.15	source	(unstable)	(not affected)
golang-1.19	source	(unstable)	(not affected)
golang-1.24	source	(unstable)	(not affected)
golang-1.25	source	(unstable)	(not affected)
golang-1.26	source	(unstable)	1.26.1-1

Notes

- golang-1.25 <not-affected> (Vulnerable code not present)
- golang-1.24 <not-affected> (Vulnerable code not present)
- golang-1.19 <not-affected> (Vulnerable code not present)
- golang-1.15 <not-affected> (Vulnerable code not present)
https://github.com/golang/go/issues/77952
Fixed by: https://github.com/golang/go/commit/a761c9ff70fec8e1089897eebd104a8f31cff2d3 (go1.26.1)