Go CVE-2026-27137

Upgrade Go to the patched version as detailed in the official Go security announcement at https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk and the fix implementation at https://go.dev/cl/752182. The patch corrects the certificate chain validation logic to properly enforce all email address constraints rather than only the last one. For applications already compiled with Go 1.26.0, recompilation with the patched Go toolchain is required since the vulnerability exists in the compiled standard library code. Red Hat Enterprise Linux users should apply RHSA-2026:5110 or RHSA-2026:5549 depending on their system version. SUSE Linux Enterprise users should apply the appropriate update from SUSE-SU-2026:0876, SUSE-SU-2026:0976, SUSE-SU-2026:0993, or SUSE-SU-2026:1042 based on their distribution. If immediate patching is not feasible, implement compensating controls by auditing certificate validation code paths to identify applications relying on email-based certificate constraints, then temporarily disable email constraint validation or implement additional application-layer authorization checks to verify email identity independently of certificate constraints (noting this reduces the security boundary and should be considered a temporary measure with increased logging/monitoring). Organizations not using email-based certificate validation for authentication or authorization are not exposed to exploitation despite running vulnerable Go versions.