CVE-2026-33810
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
| Vendor | go standard library |
| Product | crypto/x509 |
| Published | Apr 8, 2026 |
| Last Updated | Jul 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for go standard library crypto/x509
Be the first to know when new high vulnerabilities affecting go standard library crypto/x509 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Go standard library / crypto/x509
1.26.0-0 < 1.26.2
References
go.dev: https://go.dev/cl/763763 go.dev: https://go.dev/issue/78332 groups.google.com: https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU pkg.go.dev: https://pkg.go.dev/vuln/GO-2026-4866 openwall.com: http://www.openwall.com/lists/oss-security/2026/04/19/4 openwall.com: http://www.openwall.com/lists/oss-security/2026/04/20/1 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-33810 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2456335 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33810.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14391 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36796 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:28047 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:39810 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34365 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19719 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19144 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19135 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19721 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19720 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19353 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10155 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26571 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25089 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22862 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26585 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22347 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21769 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:23345 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:29854 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26568 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13545 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36651 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40945 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40118 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7291 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22485 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41928 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10158 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21772 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9385 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24478 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42043 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22960 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42047 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22958 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22962 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42050 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22959 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42051 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22961 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42049
Credits
Riyas from Saintgits College of Engineering k1rnt @1seal