Certificate verification can panic when a certificate in the chain has an empty
DNS name and another certificate in the chain has excluded name constraints.
This can crash programs that are either directly verifying X.509 certificate
chains, or those that use TLS.

Since the name constraint checks happen after chain building is complete, this
only applies to certificate chains which chain to trusted roots (root
certificates either in VerifyOptions.Roots or in the system root certificate
pool), requiring a trusted CA to issue certificates containing malformed DNS
names.

This issue only affects Go 1.26.

Thanks to Jakub Ciolek for reporting this issue.

This is CVE-2026-27138 and Go issue #77953.

This is a PRIVATE issue for CVE-2026-27138, tracked in http://b/483701609.