MEDIUM5.9

GO-2026-4600

Panic in name constraint checking for malformed certificates in crypto/x509

Quick fix

GO-2026-4600 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.26.1

Details

Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/stdlib

Introduced in: 1.26.0-0Fixed in: 1.26.1

Fixgo get stdlib@v1.26.1

References

https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk[WEB]
https://go.dev/issue/77953[REPORT]
https://go.dev/cl/752183[FIX]