CVE-2022-27536: Golang Go

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.

Affected products

• Golang Go: from 1.18.0, before 1.18.1 (fixed in 1.18.1)

Published 2022-04-20. Last modified 2026-06-17.