Loading story…
An Important vulnerability tracked as CVE-2026-33810 affects Go's crypto/x509 package and can allow a certificate validation bypass during trusted certificate chain verification. The flaw stems from excluded DNS constraints not being correctly applied to wildcard DNS Subject Alternative Names when the SAN's case differs from the constraint, creating a path for a malicious certificate to be accepted when it should be rejected.
Red Hat assigned the issue a CVSS v3 score of 8.8 and warned that affected products could accept malicious certificates from otherwise trusted chains, weakening the certificate trust model. Red Hat said multiple affected products and components have been fixed through security errata, while the CVE record formally tracks the issue as CVE-2026-33810.
See affected versions and whether adversaries are exploiting it.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat listed Cryostat 4 on RHEL 9, component cryostat/cryostat-storage-rhel9, as fixed for CVE-2026-33810 in advisory RHSA-2026:14391.
Red Hat published CVE-2026-33810, describing an Important vulnerability in Go's crypto/x509 package that can allow certificate validation bypass during trusted certificate chain verification. Red Hat assigned the issue a CVSS v3 score of 8.8.
Red Hat listed Red Hat Enterprise Linux 10 component yggdrasil as fixed for CVE-2026-33810 in advisory RHSA-2026:57126.
Red Hat listed fixes for CVE-2026-33810 in Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and 8.6 Extended Update Support Long-Life Add-On for component container-tools:rhel8 in advisory RHSA-2026:51288.
Red Hat listed HawtIO 4.4.0, component hawtio-operator-container, as fixed for CVE-2026-33810 in advisory RHSA-2026:25089.
Red Hat listed Red Hat Enterprise Linux 9.4 Extended Update Support component opentelemetry-collector as fixed for CVE-2026-33810 in advisory RHSA-2026:19721.
Red Hat listed Red Hat Enterprise Linux 10.0 Extended Update Support component opentelemetry-collector as fixed for CVE-2026-33810 in advisory RHSA-2026:19719.
Red Hat listed Red Hat Enterprise Linux 9 component opentelemetry-collector as fixed for CVE-2026-33810 in advisory RHSA-2026:19353.
Red Hat listed fixes for CVE-2026-33810 in Red Hat Enterprise Linux 10 for components opentelemetry-collector and golang-github-openprinting-ipp-usb via advisories RHSA-2026:19135 and RHSA-2026:19144.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Go disclosed **CVE-2026-33810**, a certificate validation flaw in `crypto/x509` in Go 1.26 that can cause excluded DNS name constraints to be enforced incorrectly for wildcard Subject Alternative Names. The bug appears when a wildcard SAN such as `*.example.com` is evaluated against an excluded constraint written with different letter casing, such as `EXAMPLE.COM`, allowing the wildcard domain to bypass the exclusion during certificate chain verification. The issue affects otherwise trusted certificate chains anchored in `VerifyOptions.Roots` or the system certificate pool, narrowing exposure to chains that already terminate at a trusted root CA. Go tracked the bug as issue **#78332**, credited the report to Riyas from Saintgits College of Engineering, k1rnt, and @1seal, and later published a fix on the `release-branch.go1.26`; downstream vendors including SUSE also opened advisories for the vulnerability.
Jun 29, 2026
A denial-of-service vulnerability tracked as **CVE-2026-32280** was disclosed in Go's standard library, affecting `crypto/x509` and `crypto/tls` during X.509 certificate verification. The flaw stems from excessive certificate chain-building work in `Verify` when an attacker supplies a large number of candidate intermediate certificates, causing uncontrolled CPU and resource consumption and potentially making applications unavailable. The issue affects systems that use Go to process untrusted TLS certificates or X.509 chains, particularly network-facing services that accept attacker-controlled certificate inputs. Red Hat rated the vulnerability **Important** with a **CVSS v3.1 score of 7.5**, mapped it to **CWE-770**, and published fixes across multiple products, including **Red Hat Enterprise Linux 10 golang** and several **Ansible Automation Platform**, **Cryostat**, and **HawtIO** components.
Aug 20, 2026
A denial-of-service vulnerability tracked as **CVE-2026-32281** was disclosed in Go’s `crypto/x509` package after maintainers found certificate policy validation can degrade to quadratic work when processing chains with very large `PolicyMappings`. The flaw affects verification of otherwise trusted certificate chains anchored in `VerifyOptions.Roots` or the system certificate pool, allowing excessive CPU and resource consumption during chain validation. Exploitation requires a specially crafted chain tied to a compromised trusted root, but Red Hat still rated the issue **Moderate** while noting higher severity scores were assigned by other scoring authorities. Red Hat said fixes were issued across a wide range of products, including multiple **Red Hat Enterprise Linux** versions and update streams, **Satellite**, **Cryostat**, **OpenStack**, **Ansible Automation Platform**, and **RHEM/flightctl**, with additional affected products added as availability changed after initial triage. Red Hat also stated there is **no acceptable mitigation** short of applying vendor updates, making patch deployment the primary response for organizations running Go-based services or platforms that rely on `crypto/x509` certificate chain validation.
Sep 1, 2026