CVE-2026-33810

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
References
Link Resource
https://go.dev/cl/763763 Patch
https://go.dev/issue/78332 Issue Tracking
https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU Mailing List Release Notes
https://pkg.go.dev/vuln/GO-2026-4866 Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/19/4
http://www.openwall.com/lists/oss-security/2026/04/20/1
https://access.redhat.com/errata/RHSA-2026:10155
https://access.redhat.com/errata/RHSA-2026:10158
https://access.redhat.com/errata/RHSA-2026:13545
https://access.redhat.com/errata/RHSA-2026:14391
https://access.redhat.com/errata/RHSA-2026:19135
https://access.redhat.com/errata/RHSA-2026:19144
https://access.redhat.com/errata/RHSA-2026:19353
https://access.redhat.com/errata/RHSA-2026:19719
https://access.redhat.com/errata/RHSA-2026:19720
https://access.redhat.com/errata/RHSA-2026:19721
https://access.redhat.com/errata/RHSA-2026:21769
https://access.redhat.com/errata/RHSA-2026:21772
https://access.redhat.com/errata/RHSA-2026:22347
https://access.redhat.com/errata/RHSA-2026:22485
https://access.redhat.com/errata/RHSA-2026:22862
https://access.redhat.com/errata/RHSA-2026:22958
https://access.redhat.com/errata/RHSA-2026:22959
https://access.redhat.com/errata/RHSA-2026:22960
https://access.redhat.com/errata/RHSA-2026:22961
https://access.redhat.com/errata/RHSA-2026:22962
https://access.redhat.com/errata/RHSA-2026:23345
https://access.redhat.com/errata/RHSA-2026:24478
https://access.redhat.com/errata/RHSA-2026:25089
https://access.redhat.com/errata/RHSA-2026:26568
https://access.redhat.com/errata/RHSA-2026:26571
https://access.redhat.com/errata/RHSA-2026:26585
https://access.redhat.com/errata/RHSA-2026:28047
https://access.redhat.com/errata/RHSA-2026:29854
https://access.redhat.com/errata/RHSA-2026:34365
https://access.redhat.com/errata/RHSA-2026:36651
https://access.redhat.com/errata/RHSA-2026:36796
https://access.redhat.com/errata/RHSA-2026:39810
https://access.redhat.com/errata/RHSA-2026:40118
https://access.redhat.com/errata/RHSA-2026:40945
https://access.redhat.com/errata/RHSA-2026:41928
https://access.redhat.com/errata/RHSA-2026:42043
https://access.redhat.com/errata/RHSA-2026:42047
https://access.redhat.com/errata/RHSA-2026:42049
https://access.redhat.com/errata/RHSA-2026:42050
https://access.redhat.com/errata/RHSA-2026:42051
https://access.redhat.com/errata/RHSA-2026:47952
https://access.redhat.com/errata/RHSA-2026:7291
https://access.redhat.com/errata/RHSA-2026:9385
https://access.redhat.com/security/cve/CVE-2026-33810
https://bugzilla.redhat.com/show_bug.cgi?id=2456335
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33810.json
Configurations

Configuration 1 (hide)

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

History

30 Jul 2026, 12:18

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:47952 -

24 Jul 2026, 22:10

Type Values Removed Values Added
Summary
  • (es) Al verificar una cadena de certificados que contiene restricciones DNS excluidas, estas restricciones no se aplican correctamente a los SAN DNS comodín que utilizan mayúsculas/minúsculas diferentes a las de la restricción. Esto solo afecta la validación de cadenas de certificados que de otro modo serían de confianza, emitidas por una CA raíz en el CertPool VerifyOptions.Roots o en el grupo de certificados del sistema.

21 Jul 2026, 12:18

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:41928 -
  • () https://access.redhat.com/errata/RHSA-2026:42043 -
  • () https://access.redhat.com/errata/RHSA-2026:42047 -
  • () https://access.redhat.com/errata/RHSA-2026:42049 -
  • () https://access.redhat.com/errata/RHSA-2026:42050 -
  • () https://access.redhat.com/errata/RHSA-2026:42051 -

17 Jul 2026, 13:18

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:40945 -

16 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:40118 -

15 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:39810 -

09 Jul 2026, 13:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36651 -
  • () https://access.redhat.com/errata/RHSA-2026:36796 -

02 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:34365 -

30 Jun 2026, 03:18

Type Values Removed Values Added
CWE CWE-1289
References
  • () https://access.redhat.com/errata/RHSA-2026:10155 -
  • () https://access.redhat.com/errata/RHSA-2026:10158 -
  • () https://access.redhat.com/errata/RHSA-2026:13545 -
  • () https://access.redhat.com/errata/RHSA-2026:14391 -
  • () https://access.redhat.com/errata/RHSA-2026:19135 -
  • () https://access.redhat.com/errata/RHSA-2026:19144 -
  • () https://access.redhat.com/errata/RHSA-2026:19353 -
  • () https://access.redhat.com/errata/RHSA-2026:19719 -
  • () https://access.redhat.com/errata/RHSA-2026:19720 -
  • () https://access.redhat.com/errata/RHSA-2026:19721 -
  • () https://access.redhat.com/errata/RHSA-2026:21769 -
  • () https://access.redhat.com/errata/RHSA-2026:21772 -
  • () https://access.redhat.com/errata/RHSA-2026:22347 -
  • () https://access.redhat.com/errata/RHSA-2026:22485 -
  • () https://access.redhat.com/errata/RHSA-2026:22862 -
  • () https://access.redhat.com/errata/RHSA-2026:22958 -
  • () https://access.redhat.com/errata/RHSA-2026:22959 -
  • () https://access.redhat.com/errata/RHSA-2026:22960 -
  • () https://access.redhat.com/errata/RHSA-2026:22961 -
  • () https://access.redhat.com/errata/RHSA-2026:22962 -
  • () https://access.redhat.com/errata/RHSA-2026:23345 -
  • () https://access.redhat.com/errata/RHSA-2026:24478 -
  • () https://access.redhat.com/errata/RHSA-2026:25089 -
  • () https://access.redhat.com/errata/RHSA-2026:26568 -
  • () https://access.redhat.com/errata/RHSA-2026:26571 -
  • () https://access.redhat.com/errata/RHSA-2026:26585 -
  • () https://access.redhat.com/errata/RHSA-2026:28047 -
  • () https://access.redhat.com/errata/RHSA-2026:29854 -
  • () https://access.redhat.com/errata/RHSA-2026:7291 -
  • () https://access.redhat.com/errata/RHSA-2026:9385 -
  • () https://access.redhat.com/security/cve/CVE-2026-33810 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2456335 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33810.json -

20 Apr 2026, 18:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/04/20/1 -

19 Apr 2026, 23:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/04/19/4 -
References () https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU - Release Notes, Mailing List () https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU - Mailing List, Release Notes

17 Apr 2026, 20:41

Type Values Removed Values Added
References () https://go.dev/cl/763763 - () https://go.dev/cl/763763 - Patch
References () https://go.dev/issue/78332 - () https://go.dev/issue/78332 - Issue Tracking
References () https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU - () https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU - Release Notes, Mailing List
References () https://pkg.go.dev/vuln/GO-2026-4866 - () https://pkg.go.dev/vuln/GO-2026-4866 - Vendor Advisory
CVSS v2 : unknown
v3 : 7.5
v2 : unknown
v3 : 8.2
CWE CWE-295
CPE cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
First Time Golang go
Golang

13 Apr 2026, 19:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5

08 Apr 2026, 02:16

Type Values Removed Values Added
New CVE

Information

Published : 2026-04-08 02:16

Updated : 2026-08-04 13:18


NVD link : CVE-2026-33810

Mitre link : CVE-2026-33810

CVE.ORG link : CVE-2026-33810


JSON object : View

Products Affected

golang

  • go
CWE
CWE-295

Improper Certificate Validation

CWE-1289

Improper Validation of Unsafe Equivalence in Input