CVE-2026-33810

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

Scoring

Severity

HIGH

CVSS base score

8.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L

EPSS probability

0.34%

Published

2026-04-08

Last modified

2026-09-16

Affected products

• Go standard library crypto/x509

Markdown version · Browse all CVEs