Go X.509 Email Name Constraints Bug CVE-2026-27137 Fixed in Go 1.26.1
A subtle correctness bug in Go's X.509 verification code—tracked as CVE-2026-27137—can cause certificate chains to ignore multiple email-address name constraints when those constraints share the...