PT-2026-23662 · Amazon Web Services · Aws-Lambda

Jakub Ciolek · Published 2026-03-06 · Updated 2026-03-09 · CVE-2026-27137

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions AWS Lambda (affected versions not specified)

Description A flaw exists in AWS Lambda base images utilizing stdlib. Specifically, when validating a certificate chain with multiple email address constraints that share common local portions but differ in domain portions, the constraints are not correctly applied. Only the last constraint in the chain is considered during verification.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-27137

GO-2026-4599

OPENSUSE-SU-2026:10299-1

Affected Products

Aws-Lambda

References · 19

• https://osv.dev/vulnerability/openSUSE-SU-2026:10299-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27137 · Security Note
• https://osv.dev/vulnerability/GO-2026-4599 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-27142 · Note
• https://suse.com/security/cve/CVE-2026-27139 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note
• https://twitter.com/CVEnew/status/2030385147543982265 · Twitter Post
• https://go.dev/issue/77952 · Note
• https://twitter.com/LambdaWatchdog/status/2030252356613411052 · Twitter Post
• https://twitter.com/golang/status/2029728083977048189 · Twitter Post
• https://suse.com/security/cve/CVE-2026-25679 · Note
• https://twitter.com/LambdaWatchdog/status/2030614735528333566 · Twitter Post
• https://twitter.com/oss_security/status/2030835520809435408 · Twitter Post
• https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk · Note
• https://go.dev/cl/752182 · Note