PT-2026-23663 · Amazon+1 · Aws-Lambda+1

Jakub Ciolek · Published 2026-03-06 · Updated 2026-03-09 · CVE-2026-27138

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions AWS Lambda (affected versions not specified)

Description A flaw exists where certificate verification can lead to a program crash. This occurs when a certificate within a chain lacks a DNS name while another certificate in the same chain has excluded name constraints. This issue impacts programs directly verifying X.509 certificate chains or those utilizing TLS. The issue affects 27 Lambda base images using stdlib.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-27138

GO-2026-4600

OPENSUSE-SU-2026:10299-1

Affected Products

Aws-Lambda

Stdlib

References · 19

• https://osv.dev/vulnerability/GO-2026-4600 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10299-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27138 · Security Note
• https://suse.com/security/cve/CVE-2026-27142 · Note
• https://go.dev/issue/77953 · Note
• https://suse.com/security/cve/CVE-2026-27139 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note
• https://t.me/cveNotify/154545 · Telegram Post
• https://twitter.com/CVEnew/status/2030385146461814825 · Twitter Post
• https://twitter.com/LambdaWatchdog/status/2030252362913198155 · Twitter Post
• https://twitter.com/golang/status/2029728083977048189 · Twitter Post
• https://suse.com/security/cve/CVE-2026-25679 · Note
• https://twitter.com/oss_security/status/2030835520809435408 · Twitter Post
• https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk · Note
• https://t.me/CVEtracker/46658 · Telegram Post