The vulnerability in Go's crypto/x509 package arises from incorrect application of excluded DNS constraints during certificate chain verification. Specifically, when verifying a certificate chain containing excluded DNS constraints, these constraints are not properly enforced against wildcard DNS SANs if the case of the SAN differs from the constraint. This can lead to acceptance of malicious certificates that should have been rejected, compromising the trust model. The flaw affects validation of trusted certificate chains issued by root CAs in the VerifyOptions.Roots CertPool or system certificate pool. Red Hat has released security updates addressing this issue in their build of Cryostat 4 on RHEL 9. The vulnerability is tracked as CVE-2026-33810 and is associated with CWE-295 (Improper Certificate Validation) and CWE-1289 (Improper Validation of Unsafe Equivalence in Input).

An attacker could exploit this vulnerability to bypass certificate validation by exploiting case differences in wildcard DNS SANs relative to excluded DNS constraints. This may allow acceptance of malicious certificates within otherwise trusted certificate chains, potentially undermining the trust model and enabling man-in-the-middle or impersonation attacks in affected applications relying on Go's crypto/x509 package for certificate validation. The vulnerability does not impact confidentiality but has a high impact on integrity. There are no known exploits in the wild at this time.

Red Hat has released security updates that fix this vulnerability in their build of Cryostat 4 on RHEL 9. Users should apply the relevant security updates as provided by Red Hat to remediate this issue. Before applying the update, ensure all previously released errata relevant to your system have been applied. For details on applying updates, refer to Red Hat's official guidance. No other mitigations are specifically noted by the vendor advisory. Patch status is confirmed as fixed in the updated Red Hat packages.