CVE-2026-27137: 
Go vulnerability analysis and mitigation

CVE-2026-27137 is an improper certificate validation vulnerability (CWE-295) in the Go standard library's crypto/x509 package. When verifying a certificate chain containing a certificate with multiple email address constraints that share common local portions but differ in domain portions, only the last constraint is evaluated — effectively bypassing all earlier restrictions. The vulnerability affects Go versions prior to 1.26.1, as well as Microsoft Azure Linux 3 packages azl3_golang_1.25.7-1 and azl3_golang_1.26.0-1. It was published on March 6, 2026, with a patch released March 11, 2026. The CVSS v3.1 base score is 7.5 (High) (Microsoft MSRC, pkg.go.dev).

The root cause is improper enforcement of Name Constraints in X.509 certificate chains (CWE-295), tracked as GO-2026-4599 in the Go vulnerability database. Specifically, when a certificate contains multiple rfc822Name (email address) constraints with identical local parts (the portion before @) but different domain parts, the Go crypto/x509 validation logic fails to apply all constraints and only considers the final one. An attacker who can present a crafted certificate chain — for example, one where an earlier constraint would block a given email domain — can bypass that restriction because only the last constraint is checked. The issue is documented in Go issue #77952 and fixed via code review CL 752182 (pkg.go.dev, Go Issue).

Successful exploitation allows an attacker to bypass certificate-based access controls that rely on email address constraints, potentially enabling impersonation of restricted email identities or unauthorized access to systems that trust the malformed certificate chain. The CVSS scoring reflects a high availability impact (score 7.5), though the practical security consequence is primarily an integrity/authentication bypass — allowing malicious certificates to be accepted when they should be rejected. Downstream products incorporating the vulnerable Go standard library, including IBM App Connect Enterprise Certified Container and IBM Instana Observability, are also affected (IBM Advisory, IBM Instana).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (pkg.go.dev, Microsoft MSRC).

The Go project released a fix in Go 1.26.1, which correctly enforces all email address constraints during certificate chain validation. Microsoft published a patch on March 11, 2026, for affected Azure Linux 3 packages (azl3_golang_1.25.7-1, azl3_golang_1.26.0-1). IBM has issued advisories for App Connect Enterprise Certified Container and IBM Instana Observability, and users of those products should apply the vendor-supplied updates. Red Hat has also released multiple errata (e.g., RHSA-2026:8167, RHSA-2026:8337, and others) for affected Go packages in RHEL. Organizations should prioritize upgrading all Go installations to 1.26.1 or later and audit any systems relying on certificate chain validation with email address constraints (pkg.go.dev, Microsoft MSRC, IBM Advisory).

The Go team announced the fix via the golang-announce mailing list and the official Hachyderm social account. The vulnerability received coverage in Linux security news outlets and distribution security lists, including openSUSE, Red Hat, Oracle Linux, and Rocky Linux advisories. Community discussion was measured, reflecting the low exploitability and the straightforward patch path (golang-announce, oss-sec).