CVE-2026-33810: Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Modified

AliasesRHSA-2026:57126RHSA-2026:67134UBUNTU-CVE-2026-33810+521 more

Published 08-04-2026Last modified 18-09-2026

Vulnerability summary

CVE-2026-33810 is a high (CVSS 8.2) Improper Certificate Validation vulnerability in go standard library crypto/x509. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 27.6% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 04-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

8.2/10

010

High · v3.1 (NVD)

EPSS score

0.34%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 57 · Related 57

MGASA-2026-0147 OPENSUSE-SU-2026:10525-1 OPENSUSE-SU-2026:20571-1 OPENSUSE-SU-2026:21254-1 OPENSUSE-SU-2026:21483-1 RHSA-2026:19022+52 more

Timeline

08-04-2026
PublishedVulnerability first disclosed.
18-09-2026
Last modifiedVulnerability information updated.

Description

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

CVSS metrics

8 scores · 8 sources · 1 version

v3.18.2

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

28%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.34% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

actions-runner-controller< 0.14.1-r0
actions-runner-controller-fips< 0.14.1-r0
ageAll versions (No fix recorded)
apko< 1.2.15-r0
atlas-1.0< 1.0.0-r3

atlas-1.0-fips< 1.0.0-r6
atlas-1.1-fips< 1.1.0-r3
aws-eks-pod-identity-agent-fips< 0.1.37-r1
aws-iam-authenticator< 0.7.16-r1
aws-load-balancer-controller< 3.2.1-r0
aws-network-policy-agent< 1.3.2-r2
aws-privateca-issuer< 1.8.1-r7
aws-privateca-issuer-fips< 1.8.1-r1
boringssl-fips-static-2023042800-toolsAll versions (No fix recorded)
boringssl-fips-static-20240407-toolsAll versions (No fix recorded)
chainguard-partners-demoAll versions (No fix recorded)
cilium-certgen-fips-0.4< 0.4.1-r1
cilium-fips-1.16< 1.16.19-r7
cilium-fips-1.16-clustermesh-apiserver< 1.16.19-r7
cilium-fips-1.16-host-utils< 1.16.19-r7
cilium-fips-1.16-hubble-relay< 1.16.19-r7
cilium-fips-1.16-operator-aws< 1.16.19-r7
cilium-fips-1.16-operator-azure< 1.16.19-r7
cilium-fips-1.16-operator-generic< 1.16.19-r7
cilium-fips-1.17< 1.17.16-r1
cilium-fips-1.17-clustermesh-apiserver< 1.17.16-r1
cilium-fips-1.17-host-utils< 1.17.16-r1
cilium-fips-1.17-hubble-relay< 1.17.15-r0 | < 1.17.16-r1
cilium-fips-1.17-operator-aws< 1.17.15-r0 | < 1.17.16-r1
cilium-fips-1.17-operator-azure< 1.17.16-r1 | < 1.17.15-r0
cilium-fips-1.17-operator-generic< 1.17.16-r1
cilium-fips-1.18< 1.18.10-r2
cilium-fips-1.18-clustermesh-apiserver< 1.18.10-r2
cilium-fips-1.18-host-utils< 1.18.10-r2
cilium-fips-1.18-hubble-relay< 1.18.10-r2
cilium-fips-1.18-operator-aws< 1.18.10-r2
cilium-fips-1.18-operator-azure< 1.18.10-r2
cilium-fips-1.18-operator-generic< 1.18.10-r2
clickhouse-operator< 0.27.0-r2
clickhouse-operator-metrics-exporter< 0.27.0-r2
commercial-chainloop-backend< 1.61.1-r0
commercial-chainloop-cli< 1.61.1-r0
commercial-expanso-edge< 2.1.19-r0
dapr-daprd-fips-1.17< 1.17.5-r0
dapr-injector-fips-1.17< 1.17.5-r0
dapr-operator-fips-1.17< 1.17.5-r0
dapr-placement-fips-1.17< 1.17.5-r0
dapr-scheduler-fips-1.17< 1.17.5-r0
dapr-sentry-fips-1.17< 1.17.5-r0
dataplaneapi< 3.3.2-r2
dataplaneapi-fips< 3.3.3-r1
dbmate< 2.33.0-r2
dgraph< 25.3.2-r0
dkron< 4.1.0-r2
dkron-executor-gcppubsub< 4.1.0-r2
dkron-executor-grpc< 4.1.0-r2
dkron-executor-kafka< 4.1.0-r2
dkron-executor-nats< 4.1.0-r2
dkron-executor-rabbitmq< 4.1.0-r2
dkron-processor-files< 4.1.0-r2
dkron-processor-fluent< 4.1.0-r2
dkron-processor-log< 4.1.0-r2
dkron-processor-syslog< 4.1.0-r2
eks-node-monitoring-agent< 1.5.2_git20260416-r0
envoy-ratelimit< 0.0.0_git20260322-r3
envoy-ratelimit-fips< 0.0.0_git20260531-r0 | < 0.0.0_git20260322-r2
external-secrets-operator-2.2< 2.2.0-r3
external-secrets-operator-fips-2.2< 2.2.0-r3
flux-2.8< 2.8.8-r2
flux-helm-controller< 1.5.5-r2
flux-helm-controller-fips< 1.5.5-r2
flux-image-automation-controller< 1.1.1-r11
flux-image-automation-controller-fips< 1.1.4-r2
flux-image-reflector-controller< 1.1.2-r2
flux-image-reflector-controller-fips< 1.1.2-r2
flux-notification-controller< 1.8.3-r3
flux-operator< 0.50.0-r0
flux-operator-fips< 0.50.0-r0
flux-operator-mcp< 0.50.0-r0
flux-operator-mcp-fips< 0.50.0-r0
flux-source-controller< 1.8.2-r4
flux-source-controller-fips< 1.8.2-r1
flux-source-watcher< 2.1.1-r5 | < 2.1.1-r2
flux-source-watcher-fips< 2.1.1-r3
fluxcd-kustomize-mutating-webhook< 0.11.0-r5
fluxcd-kustomize-mutating-webhook-fips< 0.11.0-r0
gh< 2.90.0-r0
github-mcp-server< 1.1.2-r0
go-1.26< 1.26.2-r0
go-1.26-covdataAll versions (No fix recorded)
go-1.26-objdumpAll versions (No fix recorded)
goreleaser< 2.15.3-r1
grafana-operator< 5.22.2-r4
grafana-operator-fips< 5.23.0-r1
grafana-rollout-operator< 0.37.0-r1
hubble< 1.18.6-r6
ingress-nginx-controller-1.13< 1.13.9-r2
ingress-nginx-controller-1.14< 1.14.5-r4
ingress-nginx-controller-1.15< 1.15.6-r0
ingress-nginx-controller-fips-1.13< 1.13.9-r2
ingress-nginx-controller-fips-1.14< 1.14.5-r2
ingress-nginx-controller-fips-1.15< 1.15.6-r0 | < 1.15.2-r3
ingress-nginx-custom-error-pages-1.13< 1.13.9-r2
ingress-nginx-custom-error-pages-1.14< 1.14.5-r4 | < 1.14.5-r27
ingress-nginx-custom-error-pages-1.15< 1.15.6-r0
ingress-nginx-custom-error-pages-compat-1.14< 1.14.5-r27
ingress-nginx-custom-error-pages-fips-1.13< 1.13.9-r2
ingress-nginx-custom-error-pages-fips-1.14< 1.14.5-r2
ingress-nginx-custom-error-pages-fips-1.15< 1.15.2-r3 | < 1.15.6-r0
k8s-metacollector< 0.1.2-r7
k8s-metacollector-fips< 0.1.2-r6 | < 0.1.2-r2
karma-fips< 0.131-r1
karpenter-1.10< 1.10.0-r2
karpenter-1.11< 1.11.1-r0
karpenter-fips-1.10< 1.10.0-r2
kube-logging-logging-operator-4.1< 4.1.0-r33
kube-webhook-certgen-1.13< 1.13.9-r2
kube-webhook-certgen-1.14< 1.14.5-r12 | < 1.14.5-r4
kube-webhook-certgen-1.15< 1.15.6-r0
kube-webhook-certgen-fips-1.13< 1.13.9-r2
kube-webhook-certgen-fips-1.14< 1.14.5-r2
kube-webhook-certgen-fips-1.15< 1.15.6-r0 | < 1.15.2-r3
kubernetes-dashboard-metrics-scraper-fips< 1.2.2-r17
kubernetes-dashboard-web-fips< 1.7.0-r13
kubewatch< 2.13.0-r2
kyverno-policy-reporter-plugins-kyverno< 0.6.0-r8
kyverno-policy-reporter-plugins-kyverno-fips< 0.6.0-r3 | < 0.6.0-r8
listmonk< 6.1.0-r2
local-path-provisioner< 0.0.36-r1
local-path-provisioner-fips< 0.0.36-r1
localstack< 4.14.0-r7
mageAll versions (No fix recorded)
malcontent< 1.22.0-r1 | < 1.22.1-r0
mariadb-operator< 26.3.0-r7
mariadb-operator-fips< 26.3.0-r4
metacontroller< 4.15.0-r4
mountpoint-s3-csi-driver-2.4< 2.4.1-r11
mountpoint-s3-csi-driver-2.5< 2.5.0-r7
nemo< 2.7.3-r0
newrelic-infra-operator< 0.27.1-r0
newrelic-k8s-metadata-injection< 1.42.2-r1
newrelic-k8s-metadata-injection-fips< 1.42.2-r2
nfs-subdir-external-provisioner< 4.0.18-r41
nginx-kubernetes-ingress-fips< 5.5.0-r0
nodetaint< 0.0.5-r3
nodetaint-fips< 0.0.5-r3
nova< 3.11.14-r3
nova-fips< 3.11.14-r2
nvidia-nsight-compute-13.2All versions (No fix recorded) | < 2026.1.1.2-r6
nvidia-nsight-compute-13.3All versions (No fix recorded)
nvidia-nsight-compute-13.4< 2026.3.1.2-r0
omni-fips< 1.6.5-r0
omnibump< 0.12.5-r0
omnictl-fips< 1.6.5-r0
oras< 1.3.2-r3
oras-fips< 1.3.2-r2
osv-scanner< 2.3.5-r1
pgwatch< 5.2.0-r2
pluto< 5.23.6-r3 | < 5.24.0-r4
pluto-fips< 5.24.0-r2
podcli-fips< 6.12.0-r2
podinfo-fips< 6.12.0-r2
polaris< 10.1.7-r2
polaris-fips< 10.2.0-r3
rabbitmq-messaging-topology-operator< 1.19.2-r3
rabbitmq-messaging-topology-operator-fips< 1.19.2-r1
renovateAll versions (No fix recorded)
runc-fipsAll versions (No fix recorded)
sealed-secrets-fips< 0.36.6-r0
sealed-secrets-fips-kubeseal< 0.36.6-r0
secrets-store-csi-driver-provider-aws< 3.1.0-r2
sftpgo-plugin-eventsearch< 1.0.22-r6
sigstore-scaffolding-cloudsqlproxyAll versions (No fix recorded)
sigstore-scaffolding-ctlog-createctconfig< 0.7.31-r11
sigstore-scaffolding-ctlog-managectroots< 0.7.31-r11
sigstore-scaffolding-ctlog-verifyfulcio< 0.7.31-r11
sigstore-scaffolding-fulcio-createcerts< 0.7.31-r11
sigstore-scaffolding-getoidctoken< 0.7.31-r11
sigstore-scaffolding-rekor-createsecret< 0.7.31-r11
sigstore-scaffolding-trillian-createdb< 0.7.31-r11
sigstore-scaffolding-trillian-createtree< 0.7.31-r11
sigstore-scaffolding-trillian-updatetree< 0.7.31-r11
sigstore-scaffolding-tsa-createcertchain< 0.7.31-r11
sigstore-scaffolding-tuf-createsecret< 0.7.31-r11
sigstore-scaffolding-tuf-server< 0.7.31-r11
smarter-device-manager< 1.20.11-r32
smokescreen< 0_git20260409-r1
spire-agent< 1.14.5-r0
spire-oidc-discovery-provider< 1.14.5-r0
spire-server< 1.14.5-r0
stakater-reloader< 1.4.17-r1
supercronic< 0.2.46-r0 | < 0.2.44-r1
supercronic-fips< 0.2.46-r0
tailscale< 1.96.4-r1
temporal< 1.6.2-r3
victorialogs-fips< 1.50.0-r2 | < 1.50.0-r0
victorialogs-fips-compat< 1.50.0-r0
victoriametrics< 1.140.0-r0

Show all 198

Alpine2 products

go≥ 1.26.0, < 1.25.9-r0 | ≥ 1.26.0, < 1.26.2-r0
rclone< 1.73.5-r0

2 vendors · 200 products · Showing 200 of 345

References

97 links

go.dev/cl/763763ARTICLEREPORTWEBFIXPatch
go.dev/issue/78332ARTICLEREPORTWEBIssue Tracking
groups.google.com/g/golang-announce/c/0uYbvbPZRWUARTICLEREPORTWEBMailing ListRelease Notes
pkg.go.dev/vuln/GO-2026-4866AdvisoryREPORTWEBVendor Advisory
www.openwall.com/lists/oss-security/2026/04/19/4WEB
www.openwall.com/lists/oss-security/2026/04/20/1WEB
access.redhat.com/security/cve/CVE-2026-33810VDB EntryX Refsource REDHATREPORTAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2456335Issue TrackingX Refsource REDHATREPORT
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33810.jsonX Sadp Csaf VexWEB
access.redhat.com/errata/RHSA-2026:68334Vendor AdvisoryX Refsource REDHATAdvisory

Show all 97 references

access.redhat.com/errata/RHSA-2026:54757Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:14391Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:36796Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:28047Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:39810Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:34365Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:49703Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:67149Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:49702Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:67517Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:56143Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:59546Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:19719Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:66327Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:61313Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:19714Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:67134Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:63332Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:62577Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:62578Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:65534Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:19144Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:19135Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:65895Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:57126Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:51288Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:68504Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:61253Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:67160Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:65359Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:34192Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:57649Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:67159Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:65880Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:34196Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:61907Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:34197Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:19721Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:49712Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:67518Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:56223Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:19720Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:19353Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:10155Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:26571Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:25089Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:22862Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:47952Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:26585Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:22347Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:23345Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:51033Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:29854Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:26568Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:13545Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:36651Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:40945Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:40118Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:7291Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:22485Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:41928Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:65126Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:10158Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:21772Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:9385Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:24478Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:42043Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:22960Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:42047Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:22958Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:22962Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:42050Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:22959Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:42051Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:22961Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:42049Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:21769Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57126.jsonAdvisory
www.cve.org/CVERecord?id=CVE-2026-33810AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2026-33810AdvisoryOval
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67134.jsonAdvisory
ubuntu.com/security/CVE-2026-33810REPORT
security-tracker.debian.org/tracker/CVE-2026-33810Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33810.jsonAdvisory
security.alpinelinux.org/vuln/CVE-2026-33810Advisory