CVE-2026-27137: Golang Go

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

Affected products

• Golang Go: version 1.26.0 only

Published 2026-03-06. Last modified 2026-09-16.