Description
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Go standard library | crypto/x509 | 1.26.0-0 – < 1.26.1 | 1.26.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-1.26 | 1.26.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-1.26 | No fix yet | — |
| Ubuntu 26.04 LTS | golang-1.24 +2 | No fix yet | — |
| Ubuntu 25.10 | golang-1.24 +1 | No fix yet | — |
| Ubuntu 24.04 LTS | golang-1.24 +2 | No fix yet | — |
| Ubuntu 22.04 LTS | golang-1.24 +2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | delve | 1.25.2-3.el10_1 | RHSA-2026:8842 |
| RHEL 10 | golang +7 | 1.26.2-2.el10_2 | RHSA-2026:19022 |
| RHEL 10 | image-builder | 52.1-1.el10_2 | RHSA-2026:22937 |
| RHEL 10 | ipp-usb | 0.9.27-6.el10_2 | RHSA-2026:19049 |
| RHEL 10 | osbuild-composer +2 | 165.1-2.el10_2 | RHSA-2026:22450 |
| RHEL 10 | rhc-worker-playbook | 0.2.3-4.el10_1 | RHSA-2026:19132, RHSA-2026:10169 |
| RHEL 9 | golang +7 | 1.26.2-1.el9_8 | RHSA-2026:19181 |
| RHEL 9 | image-builder | 52.1-1.el9_8 | RHSA-2026:23228 |
| RHEL 9 | osbuild-composer +2 | 165.1-2.el9_8 | RHSA-2026:22714 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | delve | 1.26.1-1.el10_0 | RHSA-2026:49703 |
| RHEL 10.0 EUS | golang +7 | 1.26.5-1.el10_0 | RHSA-2026:49702 |
| RHEL 10.0 EUS | grafana +1 | 10.2.6-26.el10_0 | RHSA-2026:67517 |
| RHEL 10.0 EUS | grafana-pcp | 5.3.0-1.el10_0 | RHSA-2026:56143 |
| RHEL 10.0 EUS | rhc-worker-playbook | 0.2.3-4.el10_0 | RHSA-2026:10929 |
| RHEL 9.6 EUS | golang +7 | 1.26.5-1.el9_6 | RHSA-2026:49712 |
| RHEL 9.6 EUS | grafana +1 | 10.2.6-23.el9_6 | RHSA-2026:67518 |
| RHEL 9.6 EUS | grafana-pcp | 5.1.1-15.el9_6 | RHSA-2026:56223 |
| RHEL 9.6 EUS | gvisor-tap-vsock +1 | 6:0.8.5-2.el9_6.2 | RHSA-2026:28038 |
| RHEL 9.4 E4S | golang +7 | 1.26.5-1.el9_4 | RHSA-2026:57649 |
| RHEL 9.4 E4S | grafana +1 | 9.2.10-28.el9_4 | RHSA-2026:76795 |
| RHEL 9.4 E4S | grafana-pcp | 5.1.1-9.el9_4 | RHSA-2026:67159 |
| RHEL 9.2 E4S | golang +7 | 1.26.5-1.el9_2 | RHSA-2026:61253 |
| RHEL 9.2 E4S | grafana | 9.0.9-13.el9_2 | RHSA-2026:76809 |
| RHEL 9.2 E4S | grafana-pcp | 5.1.1-5.el9_2.2 | RHSA-2026:67160 |
| Red Hat OpenStack 18 | golang-github-openstack-k8s-operators-os-diff | 0.1.1-18.0.20260602234716.a95ae05.el9ost | RHSA-2026:39810 |
| Red Hat OpenStack 17 | etcd | 3.4.26-9.5.el9ost | RHSA-2026:28047 |
| Red Hat OpenStack 16 | collectd-sensubility | 0.2.1-1.1.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | erlang +20 | 23.3.4.18-2.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | etcd | 3.3.23-22.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | python-oslo-messaging +1 | 10.2.4-2.20260710155333.82281a0.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | python-pyasn1 +2 | 0.4.6-4.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | python3-glance +1 | 1:19.0.5-2.20260512165254.eb6ad61.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | python3-keystone +1 | 1:16.0.3-2.20260616134936.9d699a7.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | python3-nova +11 | 1:20.6.2-2.20260317135026.8a24acd.el8ost | RHSA-2026:54757 |
| Red Hat Hardened Images 1 | golang1.26 +6 | 1.26.2-1.hum1 | RHSA-2026:7291 |
| Red Hat Edge Manager 1 | flightctl +3 | 1.0.3-1.el9em | RHSA-2026:41019, RHSA-2026:36796 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | delve | 1.25.2-3.el10_1 | ALSA-2026:8842 |
| AlmaLinux 10 | golang +7 | 1.26.2-2.el10_2.alma.1 | ALSA-2026:19022 |
| AlmaLinux 9 | golang +7 | 1.26.2-1.el9_8 | ALSA-2026:19181 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | delve | 1.25.2-3.el10_1 | RLSA-2026:8842 |
| Rocky Linux 10 | go-fdo-client | 1.0.0-9.el10_3 | RLSA-2026:97386 |
| Rocky Linux 10 | go-fdo-server +3 | 1.0.1-6.el10_3 | RLSA-2026:97387 |
| Rocky Linux 10 | golang | 1.26.2-2.el10_2 | RLSA-2026:19022 |
| Rocky Linux 10 | image-builder | 52.1-1.el10_2.rocky.0.1 | RLSA-2026:22937 |
| Rocky Linux 10 | osbuild-composer | 165.1-2.el10_2.rocky.0.1 | RLSA-2026:22450 |
| Rocky Linux 10 | yggdrasil +1 | 0.4.10-1.el10 | RLSA-2026:97288 |
| Rocky Linux 9 | golang | 1.26.2-1.el9_8 | RLSA-2026:19181 |
| Rocky Linux 9 | image-builder | 52.1-1.el9_8 | RLSA-2026:23228 |
| Rocky Linux 9 | osbuild-composer | 165.1-2.el9_8.rocky.0.1 | RLSA-2026:22714 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | go1.26 | 1.26.1-150000.1.6.1 | SUSE-SU-2026:0876-1 |
| SLES 15 SP7 | go1.26-openssl | 1.26.1-150600.13.3.1 | SUSE-SU-2026:0976-1 |
| SLES 15 SP6 | go1.26 | 1.26.1-150000.1.6.1 | SUSE-SU-2026:0876-1 |
| SLES 15 SP6 | go1.26-openssl | 1.26.1-150600.13.3.1 | SUSE-SU-2026:0976-1 |
| SLES 15 SP5 | go1.26 | 1.26.1-150000.1.6.1 | SUSE-SU-2026:0876-1 |
| SLES 15 SP5 | go1.26-openssl | 1.26.1-150000.1.3.1 | SUSE-SU-2026:0993-1 |
| SLES 15 SP4 | go1.26 | 1.26.1-150000.1.6.1 | SUSE-SU-2026:0876-1 |
| SLES 15 SP4 | go1.26-openssl | 1.26.1-150000.1.3.1 | SUSE-SU-2026:0993-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | go1.26-openssl | 1.26.1-160000.1.1 | SUSE-SU-2026:21195-1 |
| SLES for SAP 15 SP6 | go1.26 | 1.26.1-150000.1.6.1 | SUSE-SU-2026:0876-1 |
| SLES for SAP 15 SP6 | go1.26-openssl | 1.26.1-150600.13.3.1 | SUSE-SU-2026:0976-1 |
| SLES for SAP 15 SP5 | go1.26 | 1.26.1-150000.1.6.1 | SUSE-SU-2026:0876-1 |
| SLES for SAP 15 SP5 | go1.26-openssl | 1.26.1-150000.1.3.1 | SUSE-SU-2026:0993-1 |
| SLES for SAP 15 SP4 | go1.26 | 1.26.1-150000.1.6.1 | SUSE-SU-2026:0876-1 |
| SLES for SAP 15 SP4 | go1.26-openssl | 1.26.1-150000.1.3.1 | SUSE-SU-2026:0993-1 |
| SLES 16.0 | go1.26-openssl | 1.26.1-160000.1.1 | SUSE-SU-2026:21195-1 |
| SLE HPC 15 SP5 | go1.26 | 1.26.1-150000.1.6.1 | SUSE-SU-2026:0876-1 |
| SLE HPC 15 SP5 | go1.26-openssl | 1.26.1-150000.1.3.1 | SUSE-SU-2026:0993-1 |
| SLE HPC 15 SP4 | go1.26 | 1.26.1-150000.1.6.1 | SUSE-SU-2026:0876-1 |
| SLE HPC 15 SP4 | go1.26-openssl | 1.26.1-150000.1.3.1 | SUSE-SU-2026:0993-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go1.26 | 1.26.1-1.1 | openSUSE-SU-2026:10299-1 |
| openSUSE Tumbleweed | kubelogin | 0.2.18-1.1 | openSUSE-SU-2026:10909-1 |
| openSUSE Leap 16.0 | go1.26 +1 | 1.26.1-160000.1.1 | openSUSE-SU-2026:20537-1, openSUSE-SU-2026:20342-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | go1.26 | 1.26.1-150000.1.6.1 | SUSE-SU-2026:0876-1 |
| openSUSE Leap 15.6 | go1.26-openssl | 1.26.1-150600.13.3.1 | SUSE-SU-2026:0976-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260317T205859-150000.1.152.1 | SUSE-SU-2026:1042-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | go | 1.25.8-r0 | — |
| Alpine v3.24 | rclone | 1.73.5-r0 | — |
| Alpine v3.23 | go | 1.25.8-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | 1.26.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | delve | 1.25.2-3.0.1.el10_1 | ELSA-2026-8842 |
| Oracle Linux 10 | golang +7 | 1.26.2-2.0.1.el10_2 | ELSA-2026-19022 |
| Oracle Linux 10 | image-builder | 58-1.0.1.el10 | ELSA-2026-22937 |
| Oracle Linux 10 | ipp-usb | 0.9.27-6.el10_2 | ELSA-2026-19049 |
| Oracle Linux 10 | osbuild-composer +2 | 176-1.0.1.el10_2 | ELSA-2026-22450 |
| Oracle Linux 9 | golang +7 | 1.26.2-1.0.1.el9_8 | ELSA-2026-19181 |
| Oracle Linux 9 | image-builder | 72.0.0-1.0.1.el9 | ELSA-2026-23228 |
| Oracle Linux 9 | osbuild-composer +2 | 175-1.0.1.el9_8 | ELSA-2026-22714 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | dkron +9 | 4.1.0-r2 | — |
| Wolfi rolling | flux-helm-controller | 1.5.3-r1 | — |
| Wolfi rolling | flux-image-automation-controller | 1.1.1-r3 | — |
| Wolfi rolling | flux-image-reflector-controller | 1.1.1-r1 | — |
| Wolfi rolling | flux-notification-controller | 1.8.2-r1 | — |
| Wolfi rolling | flux-source-controller | 1.8.1-r1 | — |
| Wolfi rolling | go-1.26 | 1.26.1-r0 | — |
| Wolfi rolling | grafana-operator | 5.22.1-r0 | — |
| Wolfi rolling | grafana-rollout-operator | 0.35.0-r2 | — |
| Wolfi rolling | metacontroller | 4.13.1-r1 | — |
| Wolfi rolling | nova | 3.11.13-r1 | — |
| Wolfi rolling | pluto | 5.23.5-r1 | — |
| Wolfi rolling | podcli +1 | 6.11.1-r1 | — |
| Wolfi rolling | polaris | 10.1.6-r1 | — |
| Wolfi rolling | stakater-reloader | 1.4.14-r1 | — |
| Wolfi rolling | steampipe | 2.4.0-r2 | — |
| Wolfi rolling | terragrunt | 1.0.0-r1 | — |
| Wolfi rolling | victoriametrics +8 | 1.138.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | >= 1.26.0-0, < 1.26.1 | 1.26.1 | GO-2026-4599 |
Advisories 50
- RLSA-2026:97386 Important: go-fdo-client security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97288 Important: yggdrasil security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97387 Important: go-fdo-server security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-0548 Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Nov 12, 2026
- ALSA-2026:8842 Important: delve security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19022 Important: golang security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19181 Important: golang security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-1007 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2026
- RHSA-2026:76809 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76795 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7291 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67518 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67517 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67160 Red Hat Security Advisory: grafana-pcp security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67159 Red Hat Security Advisory: grafana-pcp security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:61253 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:57649 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:56143 Red Hat Security Advisory: grafana-pcp security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:56223 Red Hat Security Advisory: grafana-pcp security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54757 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 security advisory Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:49712 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:49702 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:49703 Red Hat Security Advisory: delve security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:41019 Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.3 Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:39810 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (golang-github-openstack-k8s-operators-os-diff) security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:36796 Red Hat Security Advisory: Red Hat Edge Manager Version 1.0.3 Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:28047 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (etcd) security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:28038 Red Hat Security Advisory: gvisor-tap-vsock security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:23228 Red Hat Security Advisory: image-builder security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:22937 Red Hat Security Advisory: image-builder security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:22714 Red Hat Security Advisory: osbuild-composer security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:22450 Red Hat Security Advisory: osbuild-composer security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:19181 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:19132 Red Hat Security Advisory: rhc-worker-playbook security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:19022 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:8842 Red Hat Security Advisory: delve security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHSA-2026:19049 Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHSA-2026:10929 Red Hat Security Advisory: rhc-worker-playbook security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHSA-2026:10169 Red Hat Security Advisory: rhc-worker-playbook security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- ELSA-2026-23228 Important: image-builder security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 3, 2026
- ELSA-2026-22450 Important: osbuild-composer security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 13, 2026
- ELSA-2026-22714 Important: osbuild-composer security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 5, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- WID-SEC-2026-1730 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 16, 2026
- ELSA-2026-22937 Important: image-builder security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- ELSA-2026-19049 Important: golang-github-openprinting-ipp-usb security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 8, 2026
- ELSA-2026-19022 Important: golang security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 8, 2026
- ELSA-2026-19181 Important: golang security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 12, 2026
- RLSA-2026:22714 Important: osbuild-composer security update Rocky Linux Security Advisories · Jun 11, 2026
- RLSA-2026:22937 Important: image-builder security update Rocky Linux Security Advisories · Jun 5, 2026