{
  "cveId": "CVE-2026-27138",
  "url": "https://patchblox.com/security/cve/CVE-2026-27138",
  "summary": "CVE-2026-27138 is fixed in 5 products on 2 platforms, first by Go Programming Language 1.26.1, released March 5, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Panic in name constraint checking for malformed certificates in crypto/x509",
  "description": "Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.",
  "published": "2026-03-06T22:16:00Z",
  "severity": "Moderate",
  "cvss": 5.9,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "cwe": "CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input",
  "epss": 0.00382,
  "epssPercentile": 0.3242,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27138",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Go Programming Language",
      "fixedVersion": "1.26.1",
      "fix": "Go Programming Language 1.26.1",
      "url": "https://patchblox.com/security/fix/windows-app/golang.go-1.26.1",
      "released": "2026-03-05T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "go1.26",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.26.1-150000.1.6.1",
      "fix": "SUSE-SU-2026:0876-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0876-1",
      "released": "2026-03-11T18:35:26Z"
    },
    {
      "platform": "linux",
      "product": "go1.26",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.26.1-160000.1.1",
      "fix": "OPENSUSE-SU-2026:20342-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20342-1",
      "released": "2026-03-11T09:09:25Z"
    },
    {
      "platform": "linux",
      "product": "go1.26",
      "release": "sles 15.6",
      "fixedVersion": "1.26.1-150000.1.6.1",
      "fix": "SUSE-SU-2026:0876-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0876-1",
      "released": "2026-03-11T18:35:26Z"
    },
    {
      "platform": "linux",
      "product": "go1.26",
      "release": "sles 15.7",
      "fixedVersion": "1.26.1-150000.1.6.1",
      "fix": "SUSE-SU-2026:0876-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0876-1",
      "released": "2026-03-11T18:35:26Z"
    },
    {
      "platform": "linux",
      "product": "go1.26-openssl",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.26.1-150600.13.3.1",
      "fix": "SUSE-SU-2026:0976-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0976-1",
      "released": "2026-03-23T16:34:53Z"
    },
    {
      "platform": "linux",
      "product": "go1.26-openssl",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.26.1-160000.1.1",
      "fix": "OPENSUSE-SU-2026:20537-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20537-1",
      "released": "2026-04-14T15:36:24Z"
    },
    {
      "platform": "linux",
      "product": "go1.26-openssl",
      "release": "sles 15.6",
      "fixedVersion": "1.26.1-150600.13.3.1",
      "fix": "SUSE-SU-2026:0976-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0976-1",
      "released": "2026-03-23T16:34:53Z"
    },
    {
      "platform": "linux",
      "product": "go1.26-openssl",
      "release": "sles 15.7",
      "fixedVersion": "1.26.1-150600.13.3.1",
      "fix": "SUSE-SU-2026:0976-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0976-1",
      "released": "2026-03-23T16:34:53Z"
    },
    {
      "platform": "linux",
      "product": "go1.26-openssl",
      "release": "sles 16.0",
      "fixedVersion": "1.26.1-160000.1.1",
      "fix": "SUSE-SU-2026:21195-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-21195-1",
      "released": "2026-04-14T15:41:55Z"
    },
    {
      "platform": "linux",
      "product": "golang-1.26",
      "release": "Debian 14",
      "fixedVersion": "1.26.1-1",
      "fix": "DEBIAN-CVE-2026-27138",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-27138",
      "released": "2026-03-06T22:16:00Z"
    },
    {
      "platform": "linux",
      "product": "govulncheck-vulndb",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "0.0.20260317T205859-150000.1.152.1",
      "fix": "SUSE-SU-2026:1042-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1042-1",
      "released": "2026-03-25T15:06:52Z"
    },
    {
      "platform": "linux",
      "product": "govulncheck-vulndb",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.0.20260723T184607-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21483-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21483-1",
      "released": "2026-07-30T09:09:47Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}