Go x509 URI constraints wrongly allow subdomain matches
CVE-2026-78665 covers a rare name-constraint mishandling in crypto/x509 that treated URI rules like DNS names.
Go's standard library incorrectly applied uniformResourceIdentifier name constraints in certificate validation, allowing subtree-style matches where the rules call for exact matches. The issue is tracked as CVE-2026-78665.
The crypto/x509 code treated URI constraints as equivalent to dNSName constraints, but the two are not the same. In particular, the leading-period form of a URI constraint was handled so that it matched subtrees instead of requiring an exact match. That could let a certificate pass a name constraint check it should have failed.
Name constraints are rarely used, so the Go project is handling the report on its public security track under the Go Security Policy. Ali Sherif originally reported the flaw.