VDB

CVE-2026-33810

CVE-2026-33810 PUBLISHED CVSS 7.5 HIGH

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Reported by go · Published April 8, 2026

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
flux-operator-fipsChainguard0.50.0-r0, 0.46.0-r0
ghChainguard2.90.0-r0
buildah-debugsourceerrata.rockylinux.org1.43.1-5.el10
image-buildererrata.rockylinux.org52.1-1.el10
podman-remoteerrata.rockylinux.org5.8.2-9.el10
golang-github-openprinting-ipp-usberrata.rockylinux.org0.9.27-7.el10
opentelemetry-collectorerrata.rockylinux.org0.144.0-2.el9, 0.144.0-2.el10
cilium-certgen-fips-0.4Chainguard0.4.1-r1
yggdrasilerrata.rockylinux.org0.4.9.2-1.el10
metacontrollerChainguard4.15.0-r4
atlas-1.1-fipsChainguard1.1.0-r3
go-fdo-client-debugsourceerrata.rockylinux.org1.0.0-4.el10

51 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

VendorProductVersions
Go standard librarycrypto/x5091.26.0-0
Red HatRed Hat OpenShift AI (RHOAI)
chainguardflux-operator-fips0, 0
Red HatRed Hat OpenShift AI (RHOAI)
chainguardgh0
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support0:2.21.0-2.el10_0.3
Red HatCustom Metric Autoscaler operator for Red Hat Openshift
Red HatRed Hat Hardened Images
Red HatRed Hat Web Terminal 1.131784296127, 1780425080
Red HatRed Hat Quay 3
Red HatRed Hat OpenShift AI (RHOAI)
Red HatOpenShift API for Data Protection 1.41779809598
Red HatRed Hat OpenStack Platform 17.1
Red HatRed Hat OpenShift AI (RHOAI)
Red HatOpenShift Service Mesh 2
chainguardcilium-certgen-fips-0.40
Red HatLogging Subsystem for Red Hat OpenShift 6.21784747813
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4

…and 671 more

Timeline

  • Apr 7, 2026 CVE Published
  • Apr 8, 2026 PoC Published
  • Apr 8, 2026 Security Advisory (271 in total, the first dated here)
  • May 7, 2026 Distribution Patch (253 in total, the first dated here)
  • May 18, 2026 EPSS Score (30 in total, the first dated here)
  • Jun 22, 2026 Coalition ESS Score
  • Aug 6, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-33810
vulnetix vdb fixes CVE-2026-33810

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-33810/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 67 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›