CVE-2026-33810 Go语言证书验证绕过漏洞

package main import ( "crypto/x509" "crypto/x509/pkix" "encoding/pem" "fmt" "strings" ) // This is a conceptual PoC to demonstrate the validation logic issue. // Actual exploitation requires generating specific certificate chains. func main() { // Simulate a Name Constraint with Excluded Subtree constraint := pkix.NameConstraints{ ExcludedDNSDomains: []string{"excluded.com"}, } // Simulate a Wildcard SAN in the certificate (different case) certSAN := "*.Excluded.Com" // Note the capital E and C // The vulnerability implies that the verification logic fails here // because it does not normalize case before checking constraints. matched := false for _, domain := range constraint.ExcludedDNSDomains { // Vulnerable logic comparison (pseudo-code of the bug) if strings.Contains(certSAN, domain) { matched = true break } } if !matched { fmt.Println("[VULNERABLE] Certificate passed validation despite violating exclusion constraint.") } else { fmt.Println("[SAFE] Certificate correctly rejected.") } }