GO-2026-4866 — Vulnetix

GO-2026-4866 PUBLISHED

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Affected Products

Vendor	Product	Versions
Go	stdlib	1.26.0-0, 1.26.0-0

Timeline

Apr 7, 2026 CVE Published
May 15, 2026 CVE Updated

References

https://go.dev/cl/763763 patch
https://go.dev/issue/78332 report
https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU url

Open in Interactive Console →

$ Console Community · 100/wk Open console ›