Vulnerability · Published Apr 8, 2026 · Assigned by Go
CVE-2026-33810Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
High 7.5
In plain English
A high-severity security flaw in crypto/x509 from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 71.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | buildah | 2:1.43.1-5.el10_2 | ALSA-2026:63332 |
| AlmaLinux:10 | buildah-tests | 2:1.43.1-5.el10_2 | ALSA-2026:63332 |
| AlmaLinux:9 | git-lfs | 3.7.1-4.el9_8 | ALSA-2026:19350 |
| AlmaLinux:10 | go-fdo-client | 1.0.0-4.el10_2.7 | ALSA-2026:62577 |
| AlmaLinux:10 | go-fdo-server | 1.0.1-2.el10_2.4 | ALSA-2026:62578 |
| AlmaLinux:10 | go-fdo-server-manufacturer | 1.0.1-2.el10_2.4 | ALSA-2026:62578 |
| AlmaLinux:10 | go-fdo-server-owner | 1.0.1-2.el10_2.4 | ALSA-2026:62578 |
| AlmaLinux:10 | go-fdo-server-rendezvous | 1.0.1-2.el10_2.4 | ALSA-2026:62578 |
| AlmaLinux:10 | go-toolset | 1.26.2-2.el10_2.alma.1 | ALSA-2026:19022 |
| AlmaLinux:9 | go-toolset | 1.26.2-1.el9_8 | ALSA-2026:19181 |
| AlmaLinux:10 | golang | 1.26.2-2.el10_2.alma.1 | ALSA-2026:19022 |
| AlmaLinux:9 | golang | 1.26.2-1.el9_8 | ALSA-2026:19181 |
| AlmaLinux:10 | golang-bin | 1.26.2-2.el10_2.alma.1 | ALSA-2026:19022 |
| AlmaLinux:9 | golang-bin | 1.26.2-1.el9_8 | ALSA-2026:19181 |
| AlmaLinux:10 | golang-docs | 1.26.2-2.el10_2.alma.1 | ALSA-2026:19022 |
| AlmaLinux:9 | golang-docs | 1.26.2-1.el9_8 | ALSA-2026:19181 |
| AlmaLinux:10 | golang-misc | 1.26.2-2.el10_2.alma.1 | ALSA-2026:19022 |
| AlmaLinux:9 | golang-misc | 1.26.2-1.el9_8 | ALSA-2026:19181 |
| AlmaLinux:10 | golang-race | 1.26.2-2.el10_2.alma.1 | ALSA-2026:19022 |
| AlmaLinux:9 | golang-race | 1.26.2-1.el9_8 | ALSA-2026:19181 |
| AlmaLinux:10 | golang-src | 1.26.2-2.el10_2.alma.1 | ALSA-2026:19022 |
| AlmaLinux:9 | golang-src | 1.26.2-1.el9_8 | ALSA-2026:19181 |
| AlmaLinux:10 | golang-tests | 1.26.2-2.el10_2.alma.1 | ALSA-2026:19022 |
| AlmaLinux:9 | golang-tests | 1.26.2-1.el9_8 | ALSA-2026:19181 |
| AlmaLinux:10 | opentelemetry-collector | 0.144.0-2.el10_2 | ALSA-2026:19135 |
| AlmaLinux:9 | opentelemetry-collector | 0.144.0-2.el9_8 | ALSA-2026:19353 |
| AlmaLinux:10 | podman | 7:5.8.2-9.el10_2.alma.1 | ALSA-2026:70201 |
| AlmaLinux:10 | podman-docker | 7:5.8.2-9.el10_2.alma.1 | ALSA-2026:70201 |
| AlmaLinux:10 | podman-remote | 7:5.8.2-9.el10_2.alma.1 | ALSA-2026:70201 |
| AlmaLinux:10 | podman-tests | 7:5.8.2-9.el10_2.alma.1 | ALSA-2026:70201 |
| AlmaLinux:10 | yggdrasil | 0.4.9.2-1.el10_2.2 | ALSA-2026:57126 |
| AlmaLinux:10 | yggdrasil-devel | 0.4.9.2-1.el10_2.2 | ALSA-2026:57126 |
| Alpine:v3.23 | go | 1.25.9-r0 | ALPINE-CVE-2026-33810 |
| Alpine:v3.24 | go | 1.26.2-r0 | ALPINE-CVE-2026-33810 |
| Alpine:v3.24 | rclone | 1.73.5-r0 | ALPINE-CVE-2026-33810 |
| Debian:14 | golang-1.26 | 1.26.2-1 | DEBIAN-CVE-2026-33810 |
| Go | stdlib | 1.26.2 | GO-2026-4866 |
| Rocky Linux:10 | buildah | 2:1.43.1-5.el10_2 | RLSA-2026:63332 |
| Rocky Linux:10 | go-fdo-client | 0:1.0.0-4.el10_2.7 | RLSA-2026:62577 |
| Rocky Linux:10 | go-fdo-server | 0:1.0.1-2.el10_2.4 | RLSA-2026:62578 |
| Rocky Linux:10 | golang-github-openprinting-ipp-usb | 0:0.9.27-7.el10_2 | RLSA-2026:19144 |
| Rocky Linux:10 | image-builder | 0:52.1-1.el10_2.2.rocky.0.1 | RLSA-2026:65534 |
| Rocky Linux:10 | opentelemetry-collector | 0:0.144.0-2.el10_2 | RLSA-2026:19135 |
| Rocky Linux:9 | opentelemetry-collector | 0:0.144.0-2.el9_8 | RLSA-2026:19353 |
| Rocky Linux:10 | osbuild-composer | 0:165.1-3.el10_2.2.rocky.0.1 | RLSA-2026:65895 |
| Rocky Linux:10 | podman | 7:5.8.2-9.el10_2 | RLSA-2026:70201 |
| Rocky Linux:10 | yggdrasil | 0:0.4.9.2-1.el10_2.2 | RLSA-2026:57126 |
| Ubuntu:22.04:LTS | golang-1.18 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:22.04:LTS | golang-1.20 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:22.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:24.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:22.04:LTS | golang-1.22 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:24.04:LTS | golang-1.22 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:22.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:24.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:25.10 | golang-1.23 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:26.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:22.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:24.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:25.10 | golang-1.24 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:26.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:22.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:24.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2026-33810 |
| Ubuntu:25.10 | golang-1.25 | no fix listed | UBUNTU-CVE-2026-33810 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | crypto/x509 | 1.26.0-0 – before 1.26.2 |
Weakness: CWE-1289 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://go.dev/cl/763763
- https://go.dev/issue/78332
- https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
- https://pkg.go.dev/vuln/GO-2026-4866
- http://www.openwall.com/lists/oss-security/2026/04/19/4
- http://www.openwall.com/lists/oss-security/2026/04/20/1
- https://access.redhat.com/security/cve/CVE-2026-33810 vdb-entry, x_refsource_REDHAT
- RHBZ#2456335 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33810.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:68334 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54757 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14391 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36796 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28047 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39810 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34365 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:49703 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:67149 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:49702 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:67517 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56143 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59546 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19719 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66327 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:61313 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19714 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:67134 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:63332 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62577 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62578 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65534 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19144 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19135 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65895 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57126 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51288 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:68504 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:61253 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:67160 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65359 vendor-advisory, x_refsource_REDHAT