When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:8842 advisory.

    * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-8842 advisory.

    [1.25.2-3.0.1]
    - Disable DWARF compression which has issues (Alex Burmashev)

    [1.25.2-3]
    - Rebuild with latest Go

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:8842 advisory.

    * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
      * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:8842 advisory.

    Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full     featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're     using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as     much as possible.

    Security Fix(es):

    * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

    * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0876-1 advisory.

    Update to go1.26.1 (bsc#1255111):

    - CVE-2026-25679: net/url: reject IPv6 literal not at start of host (bsc#1259264).
    - CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints (bsc#1259266).
    - CVE-2026-27138: crypto/x509: panic in name constraint checking for malformed certificates (bsc#1259267).
    - CVE-2026-27139: os: FileInfo can escape from a Root (bsc#1259268).
    - CVE-2026-27142: html/template: URLs in meta content attribute actions are not escaped (bsc#1259265).

    Changelog:

    * go#77252 cmd/compile: miscompile of global array initialization
    * go#77407 os: Go 1.25.x regression on RemoveAll for windows
    * go#77474 cmd/go: CGO compilation fails after upgrading from Go 1.25.5 to 1.25.6 due to --define-variable     flag in       pkg-config
    * go#77529 cmd/fix, x/tools/go/analysis/passes/modernize: stringscut: OOB panic in indexArgValid analyzing       'buf.Bytes()' call
    * go#77532 net/smtp: expiry date of localhostCert for testing is too short
    * go#77536 cmd/compile: internal compiler error: 'main.func1': not lowered: v15, Load STRUCT PTR SSA
    * go#77618 strings: HasSuffix doesn't work correctly for multibyte runes in go 1.26
    * go#77623 cmd/compile: internal compiler error on : 'tried to free an already free register' with generic     function       and type >= 192 bytes
    * go#77624 cmd/fix, x/tools/go/analysis/passes/modernize: stringsbuilder breaks code when combining two       strings.Builders
    * go#77680 cmd/link: TestFlagW/-w_-linkmode=external fails on illumos
    * go#77766 cmd/fix,x/tools/go/analysis/passes/modernize: rangeint uses target platform's type in the range     expression,       breaking other platforms
    * go#77780 reflect: breaking change for reflect.Value.Interface behaviour
    * go#77786 cmd/compile: rewriteFixedLoad does not properly sign extend AuxInt
    * go#77803 cmd/fix,x/tools/go/analysis/passes/modernize: reflect.TypeOf(nil) transformed into       reflect.TypeFor[untyped nil]()
    * go#77804 cmd/fix,x/tools/go/analysis/passes/modernize: minmax breaks select statements
    * go#77805 cmd/fix, x/tools/go/analysis/passes/modernize: waitgroup leads to a compilation error
    * go#77807 cmd/fix,x/tools/go/analysis/passes/modernize: stringsbuilder ignores variables if they are used     multiple       times
    * go#77849 cmd/fix,x/tools/go/analysis/passes/modernize: stringscut rewrite changes behavior
    * go#77860 cmd/go: change go mod init default go directive back to 1.N
    * go#77899 cmd/fix, x/tools/go/analysis/passes/modernize: bad rangeint rewriting
    * go#77904 x/tools/go/analysis/passes/modernize: stringsbuilder breaks code when GenDecl is a block     declaration

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When verifying a certificate chain which contains a certificate containing multiple email address     constraints which share common local portions but different domain portions, these constraints will not be     properly applied, and only the last constraint will be considered. (CVE-2026-27137)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Golang running on the remote host is prior to 1.26.1. It is, therefore, affected by multiple vulnerabilities as referenced in the advisory.

  - When verifying a certificate chain which contains a certificate containing multiple email address     constraints (composed of the full email address) which share common local portions (the portion of the     address before the '@' character) but different domain portions (the portion of the address after the     '@' character), these constraints will not be properly applied, and only the last constraint will be     considered. This can allow certificates in the chain containing email addresses which are either not     permitted or excluded by the relevant constraints to be returned by calls to Certificate.Verify. Since     the name constraint checks happen after chain building is complete, this only applies to certificate     chains which chain to trusted roots (root certificates either in VerifyOptions.Roots or in the system     root certificate pool), requiring a trusted CA to issue certificates containing either not permitted or     excluded email addresses. (CVE-2026-27137)

  - Certificate verification can panic when a certificate in the chain has an empty DNS name and another     certificate in the chain has excluded name constraints. This can crash programs that are either directly     verifying X.509 certificate chains, or those that use TLS. Since the name constraint checks happen after     chain building is complete, this only applies to certificate chains which chain to trusted roots (root     certificates either in VerifyOptions.Roots or in the system root certificate pool), requiring a trusted     CA to issue certificates containing malformed DNS names. (CVE-2026-27138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
308150	RockyLinux 10 : delve (RLSA-2026:8842)	Nessus	Rocky Linux Local Security Checks	high
307609	Oracle Linux 10 : delve (ELSA-2026-8842)	Nessus	Oracle Linux Local Security Checks	high
307555	AlmaLinux 10 : delve (ALSA-2026:8842)	Nessus	Alma Linux Local Security Checks	high
307538	RHEL 10 : delve (RHSA-2026:8842)	Nessus	Red Hat Local Security Checks	high
303590	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.26-openssl (SUSE-SU-2026:0976-1)	Nessus	SuSE Local Security Checks	medium
303578	SUSE SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:0993-1)	Nessus	SuSE Local Security Checks	medium
302111	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.26 (SUSE-SU-2026:0876-1)	Nessus	SuSE Local Security Checks	medium
302094	openSUSE 16 Security Update : go1.26 (openSUSE-SU-2026:20342-1)	Nessus	SuSE Local Security Checks	medium
301389	Linux Distros Unpatched Vulnerability : CVE-2026-27137	Nessus	Misc.	high
301251	Golang 1.26.x < 1.26.1 Multiple Vulnerabilities	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-27137

high

Tenable Plugins

high

high

high

high

medium

medium

medium

medium

high

medium