Skip to main content
Development 2 min read 457 views

Go 1.26.1 Fixes Five Security Vulnerabilities Including Certificate Verification Panics

The Go team has released Go 1.26.1 and Go 1.25.8 with patches for five security vulnerabilities spanning crypto/x509, html/template, net/url, and os packages. Two critical certificate verification bugs can cause incorrect email constraint enforcement and verification panics that crash TLS-dependent services.

TD

TechDrop Editorial

Share:

The Go team has released Go 1.26.1 and Go 1.25.8, patching five security vulnerabilities that span the crypto/x509, html/template, net/url, and os packages. Two of the five bugs affect certificate verification in the crypto/x509 package and could crash production services or allow unauthorized access to TLS-protected resources.

Certificate Verification Bugs

CVE-2026-27137 is a logic error in how email name constraints are enforced during certificate verification. When a certificate's Name Constraints extension specifies multiple email address restrictions, Go's Certificate.Verify function only checks the last constraint in the list — silently ignoring all previous ones. This means a certificate that should be rejected because it violates an email constraint could be incorrectly accepted if it satisfies only the final constraint in the list.

CVE-2026-27138 is more immediately dangerous: when a certificate contains an empty DNS name in its excluded name constraints, the verification function panics with a nil pointer dereference. Any Go program that calls Certificate.Verify on such a certificate — including TLS servers that validate client certificates — will crash. Since the malicious certificate can be sent by any connecting client, this is effectively a remote denial-of-service vulnerability against any Go service using mutual TLS.

Both crypto/x509 bugs were introduced in Go 1.26 and do not affect Go 1.25 or earlier.

Additional Fixes

The html/template package receives a fix for a cross-site scripting risk when rendering URL values inside meta http-equiv="refresh" tags. The net/url package tightens URL parsing to reject inputs that were previously accepted but technically malformed. The os package fixes a metadata handling issue in directory listings that could allow file system root escapes under specific conditions.

Go 1.25.8 includes patches for three of the five vulnerabilities — the html/template, net/url, and os fixes. Organizations running Go 1.26 should upgrade to 1.26.1 immediately due to the severity of the certificate verification bugs.

Related Articles