CVE-2026-33810

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33810
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33810.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33810
Aliases
Downstream
AZL (2)
BELL (1)
CGA (517)
CLEANSTART (323)
DEBIAN (1)
MGASA (1)
MINI (536)
OESA (3)
openSUSE (5)
RHSA (46)
RLSA (10)
SUSE (4)
UBUNTU (1)
Related
ALSA (7)
openSUSE (5)
SUSE (4)
Published
2026-04-08T01:06:56Z
Modified
2026-09-23T13:41:35Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
Details

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

Database specific 
{
    "cna_assigner":  "Go",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33810.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "1.26.0-0"
                },
                {
                    "fixed":  "1.26.2"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/golang/go

Affected ranges

Type
GIT
Repo
https://github.com/golang/go
Events
Introduced
d90b98e65320778f3b1f99a6951ab20f04d218b3
Fixed
9c8bf0e72a6fb3b415b591b124b59fbb7cf92252
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "1.26.0"
        },
        {
            "fixed":  "1.26.2"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

go1.*
go1.26.0
go1.26.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33810.json"