← Voltar para CVEs

CVE-2026-27138

MEDIUM

5.9

Descricao

Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.

Detalhes CVE

Pontuacao CVSS v3.15.9

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Vetor de ataqueNETWORK

ComplexidadeHIGH

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado3/6/2026

Ultima modificacao3/10/2026

Fontenvd

Avistamentos honeypot0

Referencias

https://go.dev/cl/752183(security@golang.org)

https://go.dev/issue/77953(security@golang.org)

https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk(security@golang.org)

https://pkg.go.dev/vuln/GO-2026-4600(security@golang.org)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.