Loading story…
Go disclosed CVE-2026-33810, a certificate validation flaw in crypto/x509 in Go 1.26 that can cause excluded DNS name constraints to be enforced incorrectly for wildcard Subject Alternative Names. The bug appears when a wildcard SAN such as *.example.com is evaluated against an excluded constraint written with different letter casing, such as EXAMPLE.COM, allowing the wildcard domain to bypass the exclusion during certificate chain verification.
The issue affects otherwise trusted certificate chains anchored in VerifyOptions.Roots or the system certificate pool, narrowing exposure to chains that already terminate at a trusted root CA. Go tracked the bug as issue #78332, credited the report to Riyas from Saintgits College of Engineering, k1rnt, and @1seal, and later published a fix on the release-branch.go1.26; downstream vendors including SUSE also opened advisories for the vulnerability.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
SUSE tracked CVE-2026-33810 in bug 1261662, identifying it as a Go 1.26 crypto/x509 vulnerability involving excluded DNS constraints on wildcard domains. The entry reflects downstream vendor tracking of the disclosed flaw.
A commit on the Go 1.26 release branch addressed the crypto/x509 wildcard constraint map case-handling issue tied to CVE-2026-33810. This represents the code fix for the certificate validation flaw.
Go disclosed CVE-2026-33810 as a certificate validation flaw in Go 1.26's crypto/x509 package. The bug allows excluded DNS constraints to be applied incorrectly to wildcard DNS SANs when letter casing differs, potentially bypassing constraints for otherwise trusted chains.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
bugzilla.suse.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcego.dev
Open sourcedeb.freexian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT/CC disclosed **CVE-2026-9648** in the Haskell library `crypton-x509-validation`, warning that affected TLS clients may accept certificates that violate X.509 `NameConstraints`. The flaw stems from the library not enforcing the RFC 5280 safeguard, which can let an attacker who has compromised a name-constrained subordinate CA create certificates for domains outside the CA’s authorized scope and use them in malicious TLS interception. The vulnerability carries a **CVSS 9.1** rating and can expose organizations to credential theft, secret theft, and disclosure of sensitive financial data, particularly in delegated PKI environments such as banks, insurers, and large enterprises. **All prior versions are affected**, and the issue has been fixed in `crypton-x509-validation` **1.9.1**; maintainers and CERT/CC urged Haskell teams to upgrade immediately.
Jun 29, 2026
A newly disclosed vulnerability, **CVE-2026-5194**, affects wolfSSL and can cause ECDSA certificate verification routines to accept digests smaller than required because hash/digest size and OID checks are missing. The flaw is classified as `CWE-295` and weakens certificate-based authentication by reducing the assurance that an ECDSA signature was validated against the proper digest constraints. The issue impacts ECDSA/ECC verification in wolfSSL configurations where **EdDSA** or **ML-DSA** is also enabled, and the risk is greater when the public CA key is known. Public references point to a wolfSSL GitHub pull request as well as MITRE and NVD tracking, while severity data published by Tenable includes CVSS v2, v3, and v4 scoring that describes a network-reachable issue with significant confidentiality and integrity impact in newer versions.
Jun 30, 2026
Botan disclosed **CVE-2026-34580** / **GHSA-v782-6fq4-q827**, a certificate authentication bypass in **Botan 3.11.0** that can cause X.509 verification to incorrectly trust an attacker-controlled end-entity certificate. The flaw stems from `Certificate_Store::certificate_known`, which returned `true` when a stored certificate merely matched the presented certificate’s distinguished name and, if present, subject key identifier, instead of confirming the two certificates were identical. Because path validation logic introduced in Botan 3.11.0 treated that result as proof of certificate identity, an end-entity certificate could be accepted immediately as a trusted root if it reused the DN and optional subject key identifier of a legitimate trust anchor. Botan fixed the issue in **version 3.11.1**, and the advisory credits Nicholas Carlini with Claude, Anthropic for reporting the vulnerability.
Jun 29, 2026