The vulnerability CVE-2026-33810 in the Go standard library's crypto/x509 package concerns improper validation of certificate chains containing excluded DNS constraints. Specifically, the constraints are not properly applied to wildcard DNS SANs when the case differs between the constraint and the SAN. This flaw impacts the validation process for certificate chains issued by root CAs trusted in the VerifyOptions.Roots CertPool or the system certificate pool. The vulnerability is classified under CWE-295 (Improper Certificate Validation) and has a CVSS 3.1 base score of 7.5, indicating high severity. No patch or official fix has been documented by the vendor as of the published date.

This vulnerability can lead to improper acceptance of certificate chains that should be restricted by excluded DNS constraints, potentially allowing an attacker to bypass intended DNS-based restrictions in certificate validation. The impact is limited to scenarios where the affected Go crypto/x509 library is used to validate certificates with excluded DNS constraints and wildcard DNS SANs differing in case. There is no indication of confidentiality or availability impact, but integrity could be compromised due to improper validation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious when relying on the Go crypto/x509 package for certificate validation involving excluded DNS constraints and wildcard DNS SANs. Consider implementing additional application-level validation or using alternative libraries if this vulnerability impacts your threat model.