HarborGuard / CVE
Back to search
HIGHCVE-2026-33810Published Modified CNA Go

CVE-2026-33810: Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

Metrics

CVSS v3.1
7.5
Severity
HIGH
Fixed in
1.26.2
Affected Products
1

Fix available

1.26.2
Affected packages
  • Go standard library / crypto/x509
    < 1.26.2 (from 1.26.0-0)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References