This vulnerability in Go's crypto/x509 library arises from improper handling of excluded DNS constraints during certificate chain verification. The constraints fail to apply correctly to wildcard DNS SANs when there is a case mismatch between the SAN and the constraint. This flaw impacts the validation process of otherwise trusted certificate chains issued by root CAs included in the verification roots. The issue is categorized under CWE-295 (Improper Certificate Validation). No CVSS score or patch information is provided.

The vulnerability could allow a certificate chain containing excluded DNS constraints to be incorrectly validated if the wildcard DNS SAN uses a different case than the constraint. This may lead to acceptance of certificates that should be excluded based on DNS constraints, potentially undermining trust in certificate validation processes relying on the affected Go library. However, no known exploits are reported, and the impact is limited to scenarios involving excluded DNS constraints and case differences in wildcard SANs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when relying on the affected Go crypto/x509 package for certificate validation involving excluded DNS constraints and wildcard SANs with case variations. Monitoring official Go project communications for updates is recommended.