7.5
High
CVE-2026-33810 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to…
Description
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| crypto/x509 1.26 | 1.26.0-0 → < 1.26.2 | 1.26.2 |
| Cryostat 4 on RHEL 9 4.1 | earliest → < 4.1.1-7 | 4.1.1-7 |
| Red Hat OpenStack Platform 17.1 | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| HawtIO HawtIO 4.4.0 | Versions not published |
Show the 135 other branches Hide the 135 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift 6.0 1781192891 | earliest → < 1781192891 | 1781192891 |
| Logging Subsystem for Red Hat OpenShift 6.4 1780051640 | earliest → < 1780051640 | 1780051640 |
| Multicluster Global Hub 1.4.5 1779838819 | earliest → < 1779838819 | 1779838819 |
| Multicluster Global Hub 1.5.4 1779828691 | earliest → < 1779828691 | 1779828691 |
| Multicluster Global Hub 1.6.2 1780320809 | earliest → < 1780320809 | 1780320809 |
| OpenShift API for Data Protection 1.4 1779809598 | earliest → < 1779809598 | 1779809598 |
| OpenShift API for Data Protection 1.5 1779808027 | earliest → < 1779808027 | 1779808027 |
| OpenShift Compliance Operator 1 1781605005 | earliest → < 1781605005 | 1781605005 |
| Red Hat Ansible Automation Platform 2.6 1777391542 | earliest → < 1777391542 | 1777391542 |
| Red Hat Hardened Images 1.26 | earliest → < 1.26.2-1.hum1 | 1.26.2-1.hum1 |
| Red Hat Lightspeed (formerly Insights) for Runtimes 1 1.0 | earliest → < 1.0.3-1779996197 | 1.0.3-1779996197 |
| Red Hat OpenShift Builds 1.6.5 1776847666 | earliest → < 1776847666 | 1776847666 |
| Red Hat OpenShift Builds 1.7.3 1776846936 | earliest → < 1776846936 | 1776846936 |
| Red Hat OpenShift Dev Spaces 3.28 1779829736 | earliest → < 1779829736 | 1779829736 |
| Red Hat OpenShift distributed tracing 3.9.3 1776435680 | earliest → < 1776435680 | 1776435680 |
| Red Hat Trusted Artifact Signer 1.3 1780399582 | earliest → < 1780399582 | 1780399582 |
| Red Hat Web Terminal 1.11 1784296203 | earliest → < 1784296203 | 1784296203 |
| Red Hat Web Terminal 1.11 1780423339 | earliest → < 1780423339 | 1780423339 |
| Red Hat Web Terminal 1.12 1784247610 | earliest → < 1784247610 | 1784247610 |
| Red Hat Web Terminal 1.12 1780425077 | earliest → < 1780425077 | 1780425077 |
| Red Hat Web Terminal 1.13 1784296127 | earliest → < 1784296127 | 1784296127 |
| Red Hat Web Terminal 1.13 1780425080 | earliest → < 1780425080 | 1780425080 |
| Red Hat Web Terminal 1.14 1784296114 | earliest → < 1784296114 | 1784296114 |
| Red Hat Web Terminal 1.14 1780424928 | earliest → < 1780424928 | 1780424928 |
| Red Hat Web Terminal 1.15 1784296033 | earliest → < 1784296033 | 1784296033 |
| Red Hat Web Terminal 1.15 1780424829 | earliest → < 1780424829 | 1780424829 |
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Versions not published | |
| cert-manager Operator for Red Hat OpenShift | Versions not published | |
| Confidential Compute Attestation | Versions not published | |
| Deployment Validation Operator | Versions not published | |
| Fence Agents Remediation Operator | Versions not published | |
| File Integrity Operator | Versions not published | |
| Gatekeeper 3 | Versions not published | |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| Migration Toolkit for Applications 8 | Versions not published | |
| Migration Toolkit for Containers | Versions not published | |
| mirror registry for Red Hat OpenShift | Versions not published | |
| Multicluster Engine for Kubernetes | Versions not published | |
| Node HealthCheck Operator | Versions not published | |
| OpenShift Developer Tools and Services | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| OpenShift Serverless | Versions not published | |
| Red Hat 3scale API Management Platform 2 | Versions not published | |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Connectivity Link 1 | Versions not published | |
| Red Hat Edge Manager 1 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift Cluster Manager CLI | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Red Hat OpenShift Dev Workspaces Operator | Versions not published | |
| Red Hat OpenShift GitOps | Versions not published | |
| Red Hat OpenShift on AWS | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat OpenStack Platform 16.2 | Versions not published | |
| Red Hat OpenStack Platform 18.0 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Security Profiles Operator | Versions not published | |
| Custom Metric Autoscaler operator for Red Hat Openshift | Versions not published | |
| External Secrets Operator for Red Hat OpenShift | Versions not published | |
| ExternalDNS Operator | Versions not published | |
| Logical Volume Manager Storage | Versions not published | |
| Machine Deletion Remediation Operator | Versions not published | |
| mirror registry for Red Hat OpenShift 2 | Versions not published | |
| Network Observability Operator | Versions not published | |
| OpenShift Lightspeed | Versions not published | |
| OpenShift Service Mesh 2 | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Power monitoring for Red Hat OpenShift | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat Advanced Cluster Security 4 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift for Windows Containers | Versions not published | |
| Red Hat Service Interconnect 1 | Versions not published | |
| Red Hat Service Interconnect 2 | Versions not published | |
| Service Telemetry Framework 1.5 | Versions not published | |
| streams for Apache Kafka 3 | Versions not published | |
| Zero Trust Workload Identity Manager | Versions not published | |
| Zero Trust Workload Identity Manager - Tech Preview | Versions not published | |
| Red Hat Satellite 6.19 for RHEL 9 | Versions not published | |
| Red Hat AI Inference Server | Versions not published | |
| RHEM 1.0 for RHEL 9 | Versions not published | |
| Red Hat Edge Manager 1.0 1783502438 | earliest → < 1783502438 | 1783502438 |
| Red Hat OpenShift Builds 1.7.4 1776846936 | earliest → < 1776846936 | 1776846936 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 9.4 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 9.6 Extended Update Support | Versions not published | |
| Red Hat OpenStack Platform 17.1 for RHEL 9 | Versions not published | |
| Red Hat OpenStack Services on OpenShift 18.0 | Versions not published | |
| Red Hat Edge Manager 1.1 1784127736 | earliest → < 1784127736 | 1784127736 |
| Builds for Red Hat OpenShift 1.6.0 1776847666 | earliest → < 1776847666 | 1776847666 |
| Compliance Operator 1 1781605005 | earliest → < 1781605005 | 1781605005 |
| Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 1.0 | earliest → < 1.0.3-1779996197 | 1.0.3-1779996197 |
| Red Hat multicluster global hub 1.4.3 1779838819 | earliest → < 1779838819 | 1779838819 |
| Red Hat OpenShift Builds 1.7.1 1776846936 | earliest → < 1776846936 | 1776846936 |
| Logging for Red Hat OpenShift 6.0 1781192891 | earliest → < 1781192891 | 1781192891 |
| Red Hat Migration Toolkit 1.8 1783914276 | earliest → < 1783914276 | 1783914276 |
| Red Hat multicluster global hub 1.5.2 1779828691 | earliest → < 1779828691 | 1779828691 |
| Red Hat OpenShift distributed tracing 3.9.1 1776435680 | earliest → < 1776435680 | 1776435680 |
| Multicluster Global Hub 1.5.6 1779828691 | earliest → < 1779828691 | 1779828691 |
| Multicluster Global Hub 1.6.4 1780320809 | earliest → < 1780320809 | 1780320809 |
| Logging for Red Hat OpenShift 6.4 1780051640 | earliest → < 1780051640 | 1780051640 |
| Logging Subsystem for Red Hat OpenShift 6 1781192891 | earliest → < 1781192891 | 1781192891 |
| Red Hat multicluster global hub 1.5.0 1779828691 | earliest → < 1779828691 | 1779828691 |
| Logging Subsystem for Red Hat OpenShift 6.2 1784747813 | earliest → < 1784747813 | 1784747813 |
| Logging for Red Hat OpenShift 6.2 1784747813 | earliest → < 1784747813 | 1784747813 |
| Red Hat multicluster global hub 1.4.4 1779838819 | earliest → < 1779838819 | 1779838819 |
| Red Hat multicluster global hub 1.6.0 1780320809 | earliest → < 1780320809 | 1780320809 |
| Red Hat OpenShift distributed tracing 3.9.2 1776435680 | earliest → < 1776435680 | 1776435680 |
| OpenShift API for Data Protection 1.3 1785180878 | earliest → < 1785180878 | 1785180878 |
| Multicluster Global Hub 1.5.7 1779828691 | earliest → < 1779828691 | 1779828691 |
| Multicluster Global Hub 1.6.5 1780320809 | earliest → < 1780320809 | 1780320809 |
| Red Hat multicluster global hub 1.4.2 1779838819 | earliest → < 1779838819 | 1779838819 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020260803064027 | earliest → < 8060020260803064027.ad008a3a | 8060020260803064027.ad008a3a |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020260803064027 | earliest → < 8060020260803064027.ad008a3a | 8060020260803064027.ad008a3a |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | Versions not published | |
| Builds for Red Hat OpenShift 1.6.1 1776847666 | earliest → < 1776847666 | 1776847666 |
| Red Hat Migration Toolkit for Containers 1.8 1783914276 | earliest → < 1783914276 | 1783914276 |
| Red Hat multicluster global hub 1.5.1 1779828691 | earliest → < 1779828691 | 1779828691 |
| Red Hat OpenShift Builds 1.6.4 1776847666 | earliest → < 1776847666 | 1776847666 |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | Versions not published | |
| Red Hat multicluster global hub 1.5.3 1779828691 | earliest → < 1779828691 | 1779828691 |
| Logging for Red Hat OpenShift 6 1781192891 | earliest → < 1781192891 | 1781192891 |
| Red Hat OpenShift AI 2.25 1788232548 | earliest → < 1788232548 | 1788232548 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | Versions not published | |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | Versions not published | |
| RHEM 1.1 for RHEL 10 | Versions not published | |
| RHEM 1.1 for RHEL 9 | Versions not published |
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of crypto/x509
The 15 CVEs of crypto/x509 →
CVE-2026-111943
On most platforms, Go uses the given system root certificates
6.8
Medium
CVE-2026-27145
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name…
6.5
Medium
CVE-2026-32280
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate…
7.5
High
CVE-2026-32281
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a…
7.5
High