Certificate Chain Verification Issue in Go Programming Language

CVE-2026-33810

What is CVE-2026-33810?

A vulnerability in the Go programming language arises when validating certificate chains that contain excluded DNS constraints. The issue manifests as incorrect application of these constraints to wildcard DNS Subject Alternative Names (SANs) when there is a case mismatch between the wildcard and the constraints. This flaw specifically affects the validation of otherwise trusted certificate chains, which are issued by a root Certificate Authority (CA) included in the specified CertPool or the system certificate pool.

References