UNKNOWN Go
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
GO-2026-4866 · BIT-golang-2026-33810 · CVE-2026-33810
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint.
This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes