Go 1.26.x crypto/x509 DNS Constraint Case Sensitivity
CVE-2026-33810 Published on April 8, 2026

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

NVD

Vulnerability Analysis

CVE-2026-33810 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

CHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

LOW

Availability Impact:

LOW

Weakness Type

Improper Validation of Unsafe Equivalence in Input

The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Products Associated with CVE-2026-33810

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Cryostat

Red Hat Openstack

Red Hat Enterprise Linux Eus

Red Hat Enterprise Linux (RHEL)

Red Hat Rhel Eus

Red Hat Apache Camel Hawtio

Red Hat Logging

Red Hat Multicluster Globalhub

Red Hat Openshift Api Data Protection

Red Hat Openshift Compliance Operator

Red Hat Ansible Automation Platform

Red Hat Hummingbird

Red Hat Lightspeed For Runtimes

Red Hat Openshift Builds

Red Hat Openshift Devspaces

Red Hat Openshift Distributed Tracing

Red Hat Trusted Artifact Signer

Red Hat Webterminal

Red Hat Assisted Installer

Red Hat Cert Manager

Red Hat Confidential Compute Attestation

Red Hat Deployment Validator Operator

Red Hat Workload Availability Far

Red Hat Openshift File Integrity Operator

Red Hat Gatekeeper

Red Hat Migration Toolkit Applications

Red Hat Rhmt

Red Hat Mirror Registry

Red Hat Multicluster Engine

Red Hat Workload Availability Nhc

Red Hat Ocp Tools

Red Hat Openshift Pipelines

Red Hat Serverless

Red Hat 3scale Amp

Red Hat Certifications

Red Hat Connectivity Link

Red Hat Edge Manager

Red Hat Enterprise Linux Ai

Red Hat Openshift Cluster Manager Cli

Red Hat Openshift

Red Hat Openshift Data Foundation

Red Hat Devworkspace

Red Hat Openshift Gitops

Red Hat Openshift Service On Aws

Red Hat Container Native Virtualization

Red Hat Quay

Red Hat Satellite

Red Hat Openshift Security Profiles Operator

Red Hat Openshift Custom Metrics Autoscaler

Red Hat External Secrets Operator

Red Hat Ext Dns Optr

Red Hat Lvms

Red Hat Workload Availability Mdr

Red Hat Network Observ Optr

Red Hat Openshift Lightspeed

Red Hat Service Mesh

Red Hat Openshift Power Monitoring

Red Hat Acm

Red Hat Advanced Cluster Security

Red Hat Rhdh

Red Hat Openshift Ai

Red Hat Windows Machine Config

Red Hat Service Interconnect

Red Hat Stf

Red Hat Amq Streams

Red Hat Zero Trust Workload Identity Manager

Red Hat Satellite Capsule

Red Hat Satellite Maintenance

Red Hat Satellite Utils

Red Hat Ai Inference Server

Affected Versions

Go standard library crypto/x509:

Version 1.26.0-0 and below 1.26.2 is affected.

Red Hat Cryostat 4 on RHEL 9:

Version 4.1.1-7 and below * is unaffected.

Red Hat HawtIO HawtIO 4.4.0:

Version operator-container and below * is unaffected.

Red Hat Enterprise Linux 10:

Version 0:0.144.0-2.el10_2 and below * is unaffected.

Red Hat Enterprise Linux 10:

Version 0:0.9.27-7.el10_2 and below * is unaffected.

Red Hat Enterprise Linux 10.0 Extended Update Support:

Version 0:0.144.0-2.el10_0 and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 0:0.144.0-2.el9_8 and below * is unaffected.

Red Hat Enterprise Linux 9.4 Extended Update Support:

Version 0:0.144.0-2.el9_4 and below * is unaffected.

Red Hat Enterprise Linux 9.6 Extended Update Support:

Version 0:0.144.0-2.el9_6 and below * is unaffected.

Red Hat OpenStack Platform 17.1 for RHEL 9:

Version 0:3.4.26-9.5.el9ost and below * is unaffected.

Red Hat OpenStack Services on OpenShift 18.0:

Version 0:0.1.1-18.0.20260602234716.a95ae05.el9ost and below * is unaffected.

Red Hat Satellite 6.19 for RHEL 9:

Version 0:0.0.3-5.el9sat and below * is unaffected.

Red Hat RHEM 1.0 for RHEL 9:

Version 0:1.0.3-1.el9em and below * is unaffected.

Logging Subsystem for Red Hat OpenShift 6.0:

Version 1781192891 and below * is unaffected.

Logging Subsystem for Red Hat OpenShift 6.4:

Version 1780051640 and below * is unaffected.

Red Hat Multicluster Global Hub 1.4.5:

Version 1779838819 and below * is unaffected.

Red Hat Multicluster Global Hub 1.5.4:

Version 1779828691 and below * is unaffected.

Red Hat Multicluster Global Hub 1.6.2:

Version 1780320809 and below * is unaffected.

Red Hat OpenShift API for Data Protection 1.4:

Version 1779809598 and below * is unaffected.

Red Hat OpenShift API for Data Protection 1.5:

Version 1779808027 and below * is unaffected.

Red Hat OpenShift Compliance Operator 1:

Version 1781605005 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1777391542 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502438 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194574 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784127736 and below * is unaffected.

Red Hat Hardened Images:

Version 1.26.2-1.hum1 and below * is unaffected.

Red Hat Lightspeed (formerly Insights) for Runtimes 1:

Version 1.0.3-1779996197 and below * is unaffected.

Red Hat OpenShift Builds 1.6.5:

Version 1776847666 and below * is unaffected.

Red Hat OpenShift Builds 1.7.4:

Version 1776846936 and below * is unaffected.

Red Hat OpenShift Dev Spaces 3.28:

Version 1779829736 and below * is unaffected.

Red Hat OpenShift distributed tracing 3.9.3:

Version 1776435680 and below * is unaffected.

Red Hat Trusted Artifact Signer 1.3:

Version 1780399582 and below * is unaffected.

Red Hat Web Terminal 1.11:

Version 1780423339 and below * is unaffected.

Red Hat Web Terminal 1.12:

Version 1780425077 and below * is unaffected.

Red Hat Web Terminal 1.13:

Version 1780425080 and below * is unaffected.

Red Hat Web Terminal 1.14:

Version 1780424928 and below * is unaffected.

Red Hat Web Terminal 1.15:

Version 1780424829 and below * is unaffected.

Assisted Installer for Red Hat OpenShift Container Platform 2: cert-manager Operator for Red Hat OpenShift: Red Hat Confidential Compute Attestation: Red Hat Confidential Compute Attestation: Custom Metric Autoscaler operator for Red Hat Openshift: Red Hat Deployment Validation Operator: Red Hat ExternalDNS Operator: Red Hat ExternalDNS Operator: External Secrets Operator for Red Hat OpenShift: Red Hat Fence Agents Remediation Operator: Red Hat File Integrity Operator: Red Hat Gatekeeper 3: Logging Subsystem for Red Hat OpenShift: Logging Subsystem for Red Hat OpenShift: Red Hat Logical Volume Manager Storage: Red Hat Logical Volume Manager Storage: Red Hat Logical Volume Manager Storage: Red Hat Machine Deletion Remediation Operator: Red Hat Migration Toolkit for Applications 8: Red Hat Migration Toolkit for Containers: mirror registry for Red Hat OpenShift: mirror registry for Red Hat OpenShift 2: Red Hat Multicluster Engine for Kubernetes: Red Hat Multicluster Engine for Kubernetes: Red Hat Network Observability Operator: Red Hat Node HealthCheck Operator: Red Hat OpenShift Developer Tools and Services: Red Hat OpenShift Developer Tools and Services: Red Hat OpenShift Developer Tools and Services: Red Hat OpenShift Lightspeed: Red Hat OpenShift Pipelines: Red Hat OpenShift Serverless: Red Hat OpenShift Serverless: Red Hat OpenShift Serverless: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 3: Red Hat OpenShift Service Mesh 3: Red Hat OpenShift Service Mesh 3: Red Hat OpenShift Service Mesh 3: Red Hat OpenShift Service Mesh 3: Red Hat OpenShift Service Mesh 3: Power monitoring for Red Hat OpenShift: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat Advanced Cluster Security 4: Red Hat AI Inference Server: Red Hat AI Inference Server: Red Hat AI Inference Server: Red Hat AI Inference Server: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Certification Program for Red Hat Enterprise Linux 9: Red Hat Connectivity Link 1: Red Hat Developer Hub: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Cluster Manager CLI: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat Openshift Data Foundation 4: Red Hat OpenShift Dev Workspaces Operator: Red Hat OpenShift for Windows Containers: Red Hat OpenShift GitOps: Red Hat OpenShift on AWS: Red Hat OpenShift Virtualization 4: Red Hat OpenShift Virtualization 4: Red Hat OpenShift Virtualization 4: Red Hat OpenShift Virtualization 4: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 18.0: Red Hat Quay 3: Red Hat Quay 3: Red Hat Quay 3: Red Hat Satellite 6: Red Hat Satellite 6: Red Hat Service Interconnect 1: Red Hat Service Interconnect 2: Red Hat Security Profiles Operator: Red Hat Service Telemetry Framework 1.5: Red Hat streams for Apache Kafka 3: Red Hat Zero Trust Workload Identity Manager: Red Hat Zero Trust Workload Identity Manager - Tech Preview:

Exploit Probability

EPSS

0.26%

Percentile

17.32%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.