The vulnerability CVE-2026-33810 in the Go standard library crypto/x509 package arises from incorrect application of excluded DNS constraints during certificate chain verification. Specifically, wildcard DNS SANs that differ in case from the excluded DNS constraints are not properly checked, allowing a certificate validation bypass. This affects certificate chains that are otherwise trusted and issued by root CAs present in the VerifyOptions.Roots CertPool or the system certificate pool. The issue is classified under CWE-295 (Improper Certificate Validation) and CWE-1289. The CVSS 3.1 score is 7.5 (high severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. Red Hat has published multiple advisories and errata addressing this vulnerability in their Go builds, particularly in Cryostat 4 on RHEL 9.

This vulnerability allows an attacker to bypass certificate validation by exploiting the incorrect handling of excluded DNS constraints with wildcard DNS SANs that differ in case. This can lead to acceptance of malicious certificates as valid, potentially enabling man-in-the-middle or impersonation attacks where integrity of communications is compromised. There is no direct confidentiality or availability impact reported. The vulnerability affects trusted certificate chains issued by root CAs in the trusted root pools.

Red Hat has released security updates addressing CVE-2026-33810 in their build of Cryostat 4 on RHEL 9. Users should apply these updates as detailed in the Red Hat advisories and errata to remediate the vulnerability. Before applying the update, ensure all previously released errata relevant to the system are applied. Patch status is confirmed by Red Hat advisories linked in the references. No vendor advisory indicates that no action is required or that the issue is already mitigated without updates, so applying the official fixes is recommended.