RHSA-2026:57126 — Red Hat Security Advisory: yggdrasil security update

A flaw in Go's (golang) crypto/x509 package affects certificate-chain validation. Excluded DNS constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) when the SAN's case differs from the constraint. This could allow an attacker to bypass certificate validation and cause a malicious certificate to be accepted.