# CVE-2026-33810: Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 CVE-2026-33810 is fixed in 41 products on 2 platforms, first by Go Programming Language 1.26.2, released April 7, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-33810 - Priority: High - CVSS: 9.1 (Moderate) - EPSS: 0.0035 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 8, 2026 - Weakness: CWE-295: Improper Certificate Validation - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33810 ## Description When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Windows apps | Go Programming Language | 1.26.2 | [Go Programming Language 1.26.2](https://patchblox.com/security/data/fix/windows-app/golang.go-1.26.2.md) | Apr 7, 2026 | | Linux | buildah RHEL 10 | 1.43.1-5.el10_2 | [RHSA-2026:63332](https://patchblox.com/security/data/fix/linux/rhsa-2026-63332.md) | May 7, 2026 | | Linux | buildah almalinux 10 | 2:1.43.1-5.el10_2 | [ALSA-2026:63332](https://patchblox.com/security/data/fix/linux/alsa-2026-63332.md) | Sep 3, 2026 | | Linux | buildah ol 10 | 2:1.43.1-5.0.1.el10_2 | [ELSA-2026-63332-0](https://patchblox.com/security/data/fix/linux/elsa-2026-63332-0.md) | Sep 4, 2026 | | Linux | buildah rocky 10 | 2:1.43.1-5.el10_2 | [RLSA-2026:63332](https://patchblox.com/security/data/fix/linux/rlsa-2026-63332.md) | Sep 4, 2026 | | Linux | buildah-tests almalinux 10 | 2:1.43.1-5.el10_2 | [ALSA-2026:63332](https://patchblox.com/security/data/fix/linux/alsa-2026-63332.md) | Sep 3, 2026 | | Linux | buildah-tests ol 10 | 2:1.43.1-5.0.1.el10_2 | [ELSA-2026-63332-0](https://patchblox.com/security/data/fix/linux/elsa-2026-63332-0.md) | Sep 4, 2026 | | Linux | delve RHEL 10 | 1.26.1-1.el10_0 | [RHSA-2026:49703](https://patchblox.com/security/data/fix/linux/rhsa-2026-49703.md) | Apr 30, 2026 | | Linux | flightctl RHEL 10 | 1.1.4-1.el10em | [RHSA-2026:68334](https://patchblox.com/security/data/fix/linux/rhsa-2026-68334.md) | Sep 17, 2026 | | Linux | git-lfs RHEL 10 | 3.6.1-2.el10_0.7 | [RHSA-2026:67149](https://patchblox.com/security/data/fix/linux/rhsa-2026-67149.md) | Jun 30, 2026 | | Linux | git-lfs RHEL 9 | 0:3.7.1-4.el9_8 | [RHSA-2026:19350](https://patchblox.com/security/data/fix/linux/rhsa-2026-19350.md) | May 15, 2026 | | Linux | git-lfs almalinux 9 | 3.7.1-4.el9_8 | [ALSA-2026:19350](https://patchblox.com/security/data/fix/linux/alsa-2026-19350.md) | May 19, 2026 | | Linux | go-fdo-client RHEL 10 | 1.0.0-4.el10_2.7 | [RHSA-2026:62577](https://patchblox.com/security/data/fix/linux/rhsa-2026-62577.md) | Sep 4, 2026 | | Linux | go-fdo-client almalinux 10 | 1.0.0-4.el10_2.7 | [ALSA-2026:62577](https://patchblox.com/security/data/fix/linux/alsa-2026-62577.md) | Sep 2, 2026 | | Linux | go-fdo-client ol 10 | 0:1.0.0-4.el10_2.7 | [ELSA-2026-62577-0](https://patchblox.com/security/data/fix/linux/elsa-2026-62577-0.md) | Sep 2, 2026 | | Linux | go-fdo-client rocky 10 | 0:1.0.0-4.el10_2.7 | [RLSA-2026:62577](https://patchblox.com/security/data/fix/linux/rlsa-2026-62577.md) | Sep 3, 2026 | | Linux | go-fdo-server RHEL 10 | 1.0.1-2.el10_2.4 | [RHSA-2026:62578](https://patchblox.com/security/data/fix/linux/rhsa-2026-62578.md) | Sep 3, 2026 | | Linux | go-fdo-server almalinux 10 | 1.0.1-2.el10_2.4 | [ALSA-2026:62578](https://patchblox.com/security/data/fix/linux/alsa-2026-62578.md) | Sep 2, 2026 | | Linux | go-fdo-server ol 10 | 0:1.0.1-2.el10_2.4 | [ELSA-2026-62578-0](https://patchblox.com/security/data/fix/linux/elsa-2026-62578-0.md) | Sep 2, 2026 | | Linux | go-fdo-server rocky 10 | 0:1.0.1-2.el10_2.4 | [RLSA-2026:62578](https://patchblox.com/security/data/fix/linux/rlsa-2026-62578.md) | Sep 3, 2026 | | Linux | go-fdo-server-manufacturer almalinux 10 | 1.0.1-2.el10_2.4 | [ALSA-2026:62578](https://patchblox.com/security/data/fix/linux/alsa-2026-62578.md) | Sep 2, 2026 | | Linux | go-fdo-server-manufacturer ol 10 | 0:1.0.1-2.el10_2.4 | [ELSA-2026-62578-0](https://patchblox.com/security/data/fix/linux/elsa-2026-62578-0.md) | Sep 2, 2026 | | Linux | go-fdo-server-owner almalinux 10 | 1.0.1-2.el10_2.4 | [ALSA-2026:62578](https://patchblox.com/security/data/fix/linux/alsa-2026-62578.md) | Sep 2, 2026 | | Linux | go-fdo-server-owner ol 10 | 0:1.0.1-2.el10_2.4 | [ELSA-2026-62578-0](https://patchblox.com/security/data/fix/linux/elsa-2026-62578-0.md) | Sep 2, 2026 | | Linux | go-fdo-server-rendezvous almalinux 10 | 1.0.1-2.el10_2.4 | [ALSA-2026:62578](https://patchblox.com/security/data/fix/linux/alsa-2026-62578.md) | Sep 2, 2026 | | Linux | go-fdo-server-rendezvous ol 10 | 0:1.0.1-2.el10_2.4 | [ELSA-2026-62578-0](https://patchblox.com/security/data/fix/linux/elsa-2026-62578-0.md) | Sep 2, 2026 | | Linux | go-toolset RHEL 9 | 0:1.26.2-1.el9_8 | [RHSA-2026:19181](https://patchblox.com/security/data/fix/linux/rhsa-2026-19181.md) | May 27, 2026 | | Linux | go-toolset almalinux 10 | 1.26.2-2.el10_2.alma.1 | [ALSA-2026:19022](https://patchblox.com/security/data/fix/linux/alsa-2026-19022.md) | May 19, 2026 | | Linux | go-toolset almalinux 9 | 1.26.2-1.el9_8 | [ALSA-2026:19181](https://patchblox.com/security/data/fix/linux/alsa-2026-19181.md) | May 19, 2026 | | Linux | go1.26 opensuse-leap 16.0 | 1.26.2-160000.1.1 | [OPENSUSE-SU-2026:20571-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20571-1.md) | Apr 20, 2026 | | Linux | go1.26 sles 15.6 | 1.26.2-150000.1.9.1 | [SUSE-SU-2026:1320-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1320-1.md) | Apr 14, 2026 | | Linux | go1.26 sles 15.7 | 1.26.2-150000.1.9.1 | [SUSE-SU-2026:1320-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1320-1.md) | Apr 14, 2026 | | Linux | go1.26-openssl opensuse-leap 16.0 | 1.26.4-160000.1.1 | [OPENSUSE-SU-2026:21254-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21254-1.md) | Jul 7, 2026 | | Linux | go1.26-openssl sles 16.0 | 1.26.4-160000.1.1 | [SUSE-SU-2026:22572-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22572-1.md) | Jul 7, 2026 | | Linux | golang RHEL 10 | 1.26.5-1.el10_0 | [RHSA-2026:49702](https://patchblox.com/security/data/fix/linux/rhsa-2026-49702.md) | May 27, 2026 | | Linux | golang RHEL 9 | 0:1.26.2-1.el9_8 | [RHSA-2026:19181](https://patchblox.com/security/data/fix/linux/rhsa-2026-19181.md) | May 27, 2026 | | Linux | golang almalinux 10 | 1.26.2-2.el10_2.alma.1 | [ALSA-2026:19022](https://patchblox.com/security/data/fix/linux/alsa-2026-19022.md) | May 19, 2026 | | Linux | golang almalinux 9 | 1.26.2-1.el9_8 | [ALSA-2026:19181](https://patchblox.com/security/data/fix/linux/alsa-2026-19181.md) | May 19, 2026 | | Linux | golang-1.26 Debian 14 | 1.26.2-1 | [DEBIAN-CVE-2026-33810](https://patchblox.com/security/data/fix/linux/debian-cve-2026-33810.md) | Apr 8, 2026 | | Linux | golang-bin RHEL 9 | 0:1.26.2-1.el9_8 | [RHSA-2026:19181](https://patchblox.com/security/data/fix/linux/rhsa-2026-19181.md) | May 27, 2026 | | Linux | golang-bin almalinux 10 | 1.26.2-2.el10_2.alma.1 | [ALSA-2026:19022](https://patchblox.com/security/data/fix/linux/alsa-2026-19022.md) | May 19, 2026 | | Linux | golang-bin almalinux 9 | 1.26.2-1.el9_8 | [ALSA-2026:19181](https://patchblox.com/security/data/fix/linux/alsa-2026-19181.md) | May 19, 2026 | | Linux | golang-docs RHEL 9 | 0:1.26.2-1.el9_8 | [RHSA-2026:19181](https://patchblox.com/security/data/fix/linux/rhsa-2026-19181.md) | May 27, 2026 | | Linux | golang-docs almalinux 10 | 1.26.2-2.el10_2.alma.1 | [ALSA-2026:19022](https://patchblox.com/security/data/fix/linux/alsa-2026-19022.md) | May 19, 2026 | | Linux | golang-docs almalinux 9 | 1.26.2-1.el9_8 | [ALSA-2026:19181](https://patchblox.com/security/data/fix/linux/alsa-2026-19181.md) | May 19, 2026 | | Linux | golang-github-openprinting-ipp-usb RHEL 10 | 0.9.27-7.el10_2 | [RHSA-2026:19144](https://patchblox.com/security/data/fix/linux/rhsa-2026-19144.md) | Apr 8, 2026 | | Linux | golang-github-openprinting-ipp-usb rocky 10 | 0:0.9.27-7.el10_2 | [RLSA-2026:19144](https://patchblox.com/security/data/fix/linux/rlsa-2026-19144.md) | May 29, 2026 | | Linux | golang-misc RHEL 9 | 0:1.26.2-1.el9_8 | [RHSA-2026:19181](https://patchblox.com/security/data/fix/linux/rhsa-2026-19181.md) | May 27, 2026 | | Linux | golang-misc almalinux 10 | 1.26.2-2.el10_2.alma.1 | [ALSA-2026:19022](https://patchblox.com/security/data/fix/linux/alsa-2026-19022.md) | May 19, 2026 | | Linux | golang-misc almalinux 9 | 1.26.2-1.el9_8 | [ALSA-2026:19181](https://patchblox.com/security/data/fix/linux/alsa-2026-19181.md) | May 19, 2026 | | Linux | golang-race RHEL 9 | 0:1.26.2-1.el9_8 | [RHSA-2026:19181](https://patchblox.com/security/data/fix/linux/rhsa-2026-19181.md) | May 27, 2026 | | Linux | golang-race almalinux 10 | 1.26.2-2.el10_2.alma.1 | [ALSA-2026:19022](https://patchblox.com/security/data/fix/linux/alsa-2026-19022.md) | May 19, 2026 | | Linux | golang-race almalinux 9 | 1.26.2-1.el9_8 | [ALSA-2026:19181](https://patchblox.com/security/data/fix/linux/alsa-2026-19181.md) | May 19, 2026 | | Linux | golang-src RHEL 9 | 0:1.26.2-1.el9_8 | [RHSA-2026:19181](https://patchblox.com/security/data/fix/linux/rhsa-2026-19181.md) | May 27, 2026 | | Linux | golang-src almalinux 10 | 1.26.2-2.el10_2.alma.1 | [ALSA-2026:19022](https://patchblox.com/security/data/fix/linux/alsa-2026-19022.md) | May 19, 2026 | | Linux | golang-src almalinux 9 | 1.26.2-1.el9_8 | [ALSA-2026:19181](https://patchblox.com/security/data/fix/linux/alsa-2026-19181.md) | May 19, 2026 | | Linux | golang-tests RHEL 9 | 0:1.26.2-1.el9_8 | [RHSA-2026:19181](https://patchblox.com/security/data/fix/linux/rhsa-2026-19181.md) | May 27, 2026 | | Linux | golang-tests almalinux 10 | 1.26.2-2.el10_2.alma.1 | [ALSA-2026:19022](https://patchblox.com/security/data/fix/linux/alsa-2026-19022.md) | May 19, 2026 | | Linux | golang-tests almalinux 9 | 1.26.2-1.el9_8 | [ALSA-2026:19181](https://patchblox.com/security/data/fix/linux/alsa-2026-19181.md) | May 19, 2026 | | Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | [OPENSUSE-SU-2026:21483-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21483-1.md) | Jul 30, 2026 | | Linux | grafana RHEL 10 | 10.2.6-26.el10_0 | [RHSA-2026:67517](https://patchblox.com/security/data/fix/linux/rhsa-2026-67517.md) | Jul 6, 2026 | | Linux | grafana-pcp RHEL 10 | 5.3.0-1.el10_0 | [RHSA-2026:56143](https://patchblox.com/security/data/fix/linux/rhsa-2026-56143.md) | Jun 2, 2026 | | Linux | ignition RHEL 10 | 2.21.0-2.el10_0.3 | [RHSA-2026:59546](https://patchblox.com/security/data/fix/linux/rhsa-2026-59546.md) | May 22, 2026 | | Linux | image-builder RHEL 10 | 52.1-1.el10_2.2 | [RHSA-2026:65534](https://patchblox.com/security/data/fix/linux/rhsa-2026-65534.md) | Sep 10, 2026 | | Linux | image-builder ol 10 | 0:72.0.0-1.0.2.el10 | [ELSA-2026-65534-0](https://patchblox.com/security/data/fix/linux/elsa-2026-65534-0.md) | Sep 11, 2026 | | Linux | image-builder rocky 10 | 0:52.1-1.el10_2.2.rocky.0.1 | [RLSA-2026:65534](https://patchblox.com/security/data/fix/linux/rlsa-2026-65534.md) | Sep 9, 2026 | | Linux | ipp-usb ol 10 | 0:0.9.27-7.el10_2.2 | [ELSA-2026-19144](https://patchblox.com/security/data/fix/linux/elsa-2026-19144.md) | Jul 17, 2026 | | Linux | opentelemetry-collector RHEL 10 | 0.144.0-2.el10_0 | [RHSA-2026:19719](https://patchblox.com/security/data/fix/linux/rhsa-2026-19719.md) | Apr 8, 2026 | | Linux | opentelemetry-collector RHEL 9 | 0:0.144.0-2.el9_8 | [RHSA-2026:19353](https://patchblox.com/security/data/fix/linux/rhsa-2026-19353.md) | May 27, 2026 | | Linux | opentelemetry-collector almalinux 10 | 0.144.0-2.el10_2 | [ALSA-2026:19135](https://patchblox.com/security/data/fix/linux/alsa-2026-19135.md) | May 19, 2026 | | Linux | opentelemetry-collector almalinux 9 | 0.144.0-2.el9_8 | [ALSA-2026:19353](https://patchblox.com/security/data/fix/linux/alsa-2026-19353.md) | May 19, 2026 | | Linux | opentelemetry-collector rocky 10 | 0:0.144.0-2.el10_2 | [RLSA-2026:19135](https://patchblox.com/security/data/fix/linux/rlsa-2026-19135.md) | May 29, 2026 | | Linux | opentelemetry-collector rocky 9 | 0:0.144.0-2.el9_8 | [RLSA-2026:19353](https://patchblox.com/security/data/fix/linux/rlsa-2026-19353.md) | May 28, 2026 | | Linux | osbuild-composer RHEL 10 | 134.1-12.el10_0 | [RHSA-2026:66327](https://patchblox.com/security/data/fix/linux/rhsa-2026-66327.md) | Sep 10, 2026 | | Linux | osbuild-composer ol 10 | 0:176-1.0.2.el10_2 | [ELSA-2026-65895-0](https://patchblox.com/security/data/fix/linux/elsa-2026-65895-0.md) | Sep 11, 2026 | | Linux | osbuild-composer rocky 10 | 0:165.1-3.el10_2.2.rocky.0.1 | [RLSA-2026:65895](https://patchblox.com/security/data/fix/linux/rlsa-2026-65895.md) | Sep 10, 2026 | | Linux | osbuild-composer-core ol 10 | 0:176-1.0.2.el10_2 | [ELSA-2026-65895-0](https://patchblox.com/security/data/fix/linux/elsa-2026-65895-0.md) | Sep 11, 2026 | | Linux | osbuild-composer-worker ol 10 | 0:176-1.0.2.el10_2 | [ELSA-2026-65895-0](https://patchblox.com/security/data/fix/linux/elsa-2026-65895-0.md) | Sep 11, 2026 | | Linux | podman RHEL 10 | 5.8.2-9.el10_2 | [RHSA-2026:70201](https://patchblox.com/security/data/fix/linux/rhsa-2026-70201.md) | Aug 18, 2026 | | Linux | podman almalinux 10 | 7:5.8.2-9.el10_2.alma.1 | [ALSA-2026:70201](https://patchblox.com/security/data/fix/linux/alsa-2026-70201.md) | Sep 22, 2026 | | Linux | podman ol 10 | 7:5.8.2-9.0.1.el10_2 | [ELSA-2026-70201](https://patchblox.com/security/data/fix/linux/elsa-2026-70201.md) | Sep 23, 2026 | | Linux | podman rocky 10 | 7:5.8.2-9.el10_2 | [RLSA-2026:70201](https://patchblox.com/security/data/fix/linux/rlsa-2026-70201.md) | Sep 23, 2026 | | Linux | podman-docker almalinux 10 | 7:5.8.2-9.el10_2.alma.1 | [ALSA-2026:70201](https://patchblox.com/security/data/fix/linux/alsa-2026-70201.md) | Sep 22, 2026 | | Linux | podman-docker ol 10 | 7:5.8.2-9.0.1.el10_2 | [ELSA-2026-70201](https://patchblox.com/security/data/fix/linux/elsa-2026-70201.md) | Sep 23, 2026 | | Linux | podman-remote almalinux 10 | 7:5.8.2-9.el10_2.alma.1 | [ALSA-2026:70201](https://patchblox.com/security/data/fix/linux/alsa-2026-70201.md) | Sep 22, 2026 | | Linux | podman-remote ol 10 | 7:5.8.2-9.0.1.el10_2 | [ELSA-2026-70201](https://patchblox.com/security/data/fix/linux/elsa-2026-70201.md) | Sep 23, 2026 | | Linux | podman-tests almalinux 10 | 7:5.8.2-9.el10_2.alma.1 | [ALSA-2026:70201](https://patchblox.com/security/data/fix/linux/alsa-2026-70201.md) | Sep 22, 2026 | | Linux | podman-tests ol 10 | 7:5.8.2-9.0.1.el10_2 | [ELSA-2026-70201](https://patchblox.com/security/data/fix/linux/elsa-2026-70201.md) | Sep 23, 2026 | | Linux | rhc RHEL 10 | 0.3.2-6.el10_0 | [RHSA-2026:61313](https://patchblox.com/security/data/fix/linux/rhsa-2026-61313.md) | May 7, 2026 | | Linux | rhc-worker-playbook RHEL 10 | 0.2.3-5.el10_0 | [RHSA-2026:19714](https://patchblox.com/security/data/fix/linux/rhsa-2026-19714.md) | Apr 8, 2026 | | Linux | yggdrasil RHEL 10 | 0.4.7-6.el10_0 | [RHSA-2026:67134](https://patchblox.com/security/data/fix/linux/rhsa-2026-67134.md) | Apr 8, 2026 | | Linux | yggdrasil almalinux 10 | 0.4.9.2-1.el10_2.2 | [ALSA-2026:57126](https://patchblox.com/security/data/fix/linux/alsa-2026-57126.md) | Aug 19, 2026 | | Linux | yggdrasil ol 10 | 0:0.4.9.2-1.el10_2.2 | [ELSA-2026-57126](https://patchblox.com/security/data/fix/linux/elsa-2026-57126.md) | Aug 19, 2026 | | Linux | yggdrasil rocky 10 | 0:0.4.9.2-1.el10_2.2 | [RLSA-2026:57126](https://patchblox.com/security/data/fix/linux/rlsa-2026-57126.md) | Aug 20, 2026 | | Linux | yggdrasil-devel almalinux 10 | 0.4.9.2-1.el10_2.2 | [ALSA-2026:57126](https://patchblox.com/security/data/fix/linux/alsa-2026-57126.md) | Aug 19, 2026 | | Linux | yggdrasil-devel ol 10 | 0:0.4.9.2-1.el10_2.2 | [ELSA-2026-57126](https://patchblox.com/security/data/fix/linux/elsa-2026-57126.md) | Aug 19, 2026 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.