On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
Metrics
Affected Vendors & Products
No data.
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | |||
| golang-0:1.26.10-1.el10_2 | cpe:/o:redhat:enterprise_linux:10.2 | RHSA-2026:86093 | 2026-10-20T00:00:00Z |
| Red Hat Enterprise Linux 8 | |||
| go-toolset:rhel8-8100020261020054335.a3795dee | cpe:/a:redhat:enterprise_linux:8 | RHSA-2026:86203 | 2026-10-20T00:00:00Z |
| Red Hat Hardened Images | |||
| golang1-26-main-1.26.10-0.1.hum1 | cpe:/a:redhat:hummingbird:1 | RHSA-2026:85899 | 2026-10-20T00:00:00Z |
| golang1-27-main-1.27.3-1.hum1 | cpe:/a:redhat:hummingbird:1 | RHSA-2026:86029 | 2026-10-20T00:00:00Z |
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 21 Oct 2026 02:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 21 Oct 2026 01:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse of certificate issued by the affected intermediate certificates. | On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy. |
| Title | golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority | Distrust compromised intermediate certificates in crypto/x509 |
| References |
|
Wed, 21 Oct 2026 00:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse of certificate issued by the affected intermediate certificates. | |
| Title | golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority | |
| First Time appeared |
Redhat
Redhat enterprise Linux Redhat hummingbird |
|
| Weaknesses | CWE-295 | |
| CPEs | cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:hummingbird:1 cpe:/o:redhat:enterprise_linux:10.2 |
|
| Vendors & Products |
Redhat
Redhat enterprise Linux Redhat hummingbird |
|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Go
Published:
Updated: 2026-10-21T01:24:20.498Z
Reserved: 2026-10-17T13:43:28.599Z
Link: CVE-2026-111943
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-21T01:17:20.797
Modified: 2026-10-21T02:17:06.710
Link: CVE-2026-111943
Redhat
OpenCVE Enrichment
No data.
Weaknesses