Vulnerability GO-2026-4866
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
6 months ago
April 07, 2026 at 10:53 PM UTC
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
>=1.26.0-0 <1.26.2
>=1.26.0-0 <1.26.2
Summary
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
Details
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint.
This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
1 month ago
Enforce maximum recursion depth in encoding/asn1
<1.25.13 GO-2026-5972
<1.25.13 GO-2026-5972
Unknown
1 month ago
Add recursion depth guard during decode in encoding/xml
<1.25.13 GO-2026-6088
<1.25.13 GO-2026-6088
Unknown
1 month ago
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
<1.25.13 GO-2026-6089
<1.25.13 GO-2026-6089
Unknown
1 month ago
Limit handshake messages we are willing to accept post-handshake in crypto/tls
<1.25.13 GO-2026-6090
<1.25.13 GO-2026-6090
Unknown
1 month ago
Fix Javascript regexp context tracking in html/template
<1.25.13 GO-2026-6091
<1.25.13 GO-2026-6091
Impacted packages
Timeline
Published
6 months ago
April 07, 2026 at 10:53 PM UTC
Last Modified
2 hours ago
October 07, 2026 at 10:41 AM UTC