CVE-2026-27138

Name	CVE-2026-27138
Description	Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-1.15 (PTS)	bullseye	1.15.15-1~deb11u4	fixed
golang-1.19 (PTS)	bookworm	1.19.8-2	fixed
golang-1.24 (PTS)	trixie	1.24.4-1	fixed
	forky, sid	1.24.13-2	fixed
golang-1.25 (PTS)	forky, sid	1.25.8-1	fixed
golang-1.26 (PTS)	forky, sid	1.26.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
golang-1.15	source	(unstable)	(not affected)
golang-1.19	source	(unstable)	(not affected)
golang-1.24	source	(unstable)	(not affected)
golang-1.25	source	(unstable)	(not affected)
golang-1.26	source	(unstable)	1.26.1-1

Notes

- golang-1.25 <not-affected> (Vulnerable code not present)
- golang-1.24 <not-affected> (Vulnerable code not present)
- golang-1.19 <not-affected> (Vulnerable code not present)
- golang-1.15 <not-affected> (Vulnerable code not present)
https://github.com/golang/go/issues/77953
Fixed by: https://github.com/golang/go/commit/e792d6aa952dbfdd3e8eac6f7abc3efd9df09030 (go1.26.1)