CVE-2026-27137

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

This vulnerability is rated as an Important impact because unauthenticated network entities can bypass identity restrictions without requiring local system privileges. In Red Hat environments hosting Go-based network services or container infrastructure, certificate chain validation overlooks specific email name constraints when multiple rules share an identical local mailbox name across distinct domain names. As a result, a subordinate certificate authority could successfully issue unauthorized certificates that circumvent organizational security policies, leading to improper trust establishment.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.