PT-2026-23663 · Mstdlib+1 · Stdlib+1

Jakub Ciolek · CVE-2026-27138 · Published 2026-03-06 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AWS Lambda (affected versions not specified)

Description A flaw exists where certificate verification can lead to a program crash. This occurs when a certificate within a chain lacks a DNS name while another certificate in the same chain has excluded name constraints. This issue impacts programs directly verifying X.509 certificate chains or those utilizing TLS. The issue affects 27 Lambda base images using stdlib.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

AZL-79610

AZL-79625

BDU:2026-04126

BIT-GOLANG-2026-27138

CLEANSTART-2026-AB43319

CLEANSTART-2026-AT12816

CLEANSTART-2026-BC17682

CLEANSTART-2026-BH97849

CLEANSTART-2026-EH36582

CLEANSTART-2026-FM44162

CLEANSTART-2026-FP26400

CLEANSTART-2026-GI67088

CLEANSTART-2026-GM63718

CLEANSTART-2026-GQ03231

CLEANSTART-2026-HA09227

CLEANSTART-2026-HJ72983

CLEANSTART-2026-HO16255

CLEANSTART-2026-HP74907

CLEANSTART-2026-IC13101

CLEANSTART-2026-JM96857

CLEANSTART-2026-JT42679

CLEANSTART-2026-JV11945

CLEANSTART-2026-KF61159

CLEANSTART-2026-KL41807

CLEANSTART-2026-KO23583

CLEANSTART-2026-KR58137

CLEANSTART-2026-KY82666

CLEANSTART-2026-LA67881

CLEANSTART-2026-LA96053

CLEANSTART-2026-LC57158

CLEANSTART-2026-LD38774

CLEANSTART-2026-LU57861

CLEANSTART-2026-MA49342

CLEANSTART-2026-MX70474

CLEANSTART-2026-OK95571

CLEANSTART-2026-ON62368

CLEANSTART-2026-PS51260

CLEANSTART-2026-PX55932

CLEANSTART-2026-QO29688

CLEANSTART-2026-QT53274

CLEANSTART-2026-RF77222

CLEANSTART-2026-RR25843

CLEANSTART-2026-RT37134

CLEANSTART-2026-RV11606

CLEANSTART-2026-RY70255

CLEANSTART-2026-SO86245

CLEANSTART-2026-SP88135

CLEANSTART-2026-SR26977

CLEANSTART-2026-TC31671

CLEANSTART-2026-TM31143

CLEANSTART-2026-UG20989

CLEANSTART-2026-UI21589

CLEANSTART-2026-UR38994

CLEANSTART-2026-UY60586

CLEANSTART-2026-VH00240

CLEANSTART-2026-VN16911

CLEANSTART-2026-WE55349

CLEANSTART-2026-WO16430

CLEANSTART-2026-XJ06210

CLEANSTART-2026-XN09779

CLEANSTART-2026-XP01012

CLEANSTART-2026-XP87197

CLEANSTART-2026-XR35583

CLEANSTART-2026-YB46455

CLEANSTART-2026-YN56551

CLEANSTART-2026-YS46680

CLEANSTART-2026-ZM74354

CLEANSTART-2026-ZU45532

CVE-2026-27138

GO-2026-4600

OPENSUSE-SU-2026:10299-1

OPENSUSE-SU-2026:10509-1

OPENSUSE-SU-2026:20342-1

OPENSUSE-SU-2026:20537-1

OPENSUSE-SU-2026:21483-1

RHSA-2026:7291

SUSE-SU-2026:0876-1

SUSE-SU-2026:0976-1

SUSE-SU-2026:0993-1

SUSE-SU-2026:1042-1

SUSE-SU-2026:21195-1

Affected Products

Aws-Lambda

Stdlib

References · 2186

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27138.json · Exploit
• https://osv.dev/vulnerability/CLEANSTART-2026-LA67881 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26958 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-27138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32281 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66564 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-EH36582 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58185 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33814 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-8559 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-46394 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-ON62368 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27138 · Vendor Advisory