CVE-2026-111943
published 2026-10-21CVE-2026-111943: On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further…
PriorityP424high6.8
EPSS
0.14%
3.4th percentile
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| buildah_project | buildah | — | — |
| confidential-containers | trustee | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | crun | — | — |
| container-tools_rhel8 | oci-seccomp-bpf-hook | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | runc | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
| git-lfs | git-lfs | — | — |
| go-toolset_rhel8 | golang | — | — |
| go_standard_library | crypto_x509 | < 1.26.10 | 1.26.10 |
| go_standard_library | crypto_x509 | >= 1.27.0-0 < 1.27.3 | 1.27.3 |
| grafana | grafana | — | — |
| helm | helm | — | — |
| inductiveautomation | ignition | — | — |
| kata-containers | kata-containers | — | — |
| kubernetes | cri-o | — | — |
| podman_project | podman | — | — |
| redhat | openshift | — | — |
| satellite_el8 | yggdrasil-worker-forwarder | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority
vendor_redhat·2026-10-20·CVSS 6.8
CVE-2026-111943 [HIGH] CWE-295 golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority
golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority
Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse of certificate issued by the affected intermediate certificates.
Package: helm (OpenShift Developer Tools and Services) - Affected
Package: openshift-pipelines-client (OpenShift Pipelines) - Affected
Package: kn-workflow-plugin (OpenShift Serverless) - Affected
Package: openshift-serverless-clients (OpenShift Serverless) - Affected
Package: istio-proxy (OpenShift Service Mesh 3) - Affected
Package:
VulDB
Google crypto x509 up to 1.26.9/1.27.2 Denylist Verify improper check for certificate revocation (Nessus ID 369530 / WID-SEC-2026-4049)
vuldb·2026-10-22
CVE-2026-111943 [CRITICAL] Google crypto x509 up to 1.26.9/1.27.2 Denylist Verify improper check for certificate revocation (Nessus ID 369530 / WID-SEC-2026-4049)
A vulnerability was found in Google crypto x509 up to 1.26.9/1.27.2 and classified as critical. This vulnerability affects the function Verify of the file crypto x509 of the component Denylist. Executing a manipulation can lead to improper check for certificate revocation.
This vulnerability is registered as CVE-2026-111943. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Talos
Compromised eMudhra intermediate certificates
blogs_talos·2026-10-21
CVE-2026-111943 Compromised eMudhra intermediate certificates
## Compromised eMudhra intermediate certificates
Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra . Rather than possessing the mandatory 384 bits of pseudo-random security, several private keys evaluated single-digit and double-digit integers. This misconfiguration allows an attacker with the private key of any of the compromised intermediate CAs to impersonate any website or service. Six of the TLS certificates, trusted by Chrome, Mozilla, and Apple have been blocked by these vendors already. Two other certificates, used for codesigning by Microsoft, have also been blocked. Talos expects there will be additional patches available across a variety of technologies as software applications work to remediate the certificates
Hackernews
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
blogs_hackernews·2026-10-20
CVE-2026-111943 Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20.
An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept.
A researcher reported the compromise to the root programs on the evening of October 17, and Chrome and Firefox blocked the eight certificates within hours, after Chrome verified the findings.
No TLS
Bugzilla
CVE-2026-111943 skopeo: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates [fedora-all]
bugzilla·2026-10-22
CVE-2026-111943 [HIGH] CVE-2026-111943 skopeo: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates [fedora-all]
CVE-2026-111943 skopeo: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Go releases 1.27.3 and 1.26.10 address the following issue:
https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU
crypto/x509: mitigation for security concerns with a specific Certificate Authority
We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.
Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.
We highly re
Bugzilla
CVE-2026-111943 crun: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates [fedora-all]
bugzilla·2026-10-22
CVE-2026-111943 [HIGH] CVE-2026-111943 crun: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates [fedora-all]
CVE-2026-111943 crun: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Go releases 1.27.3 and 1.26.10 address the following issue:
https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU
crypto/x509: mitigation for security concerns with a specific Certificate Authority
We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.
Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.
We highly reco
Bugzilla
CVE-2026-111943 golang: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority [fedora-all]
bugzilla·2026-10-20
CVE-2026-111943 [HIGH] CVE-2026-111943 golang: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority [fedora-all]
CVE-2026-111943 golang: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Go releases 1.27.3 and 1.26.10 address the following issue:
https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU
crypto/x509: mitigation for security concerns with a specific Certificate Authority
We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.
Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.
We
Bugzilla
CVE-2026-111943 golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority
bugzilla·2026-10-20
CVE-2026-111943 [HIGH] CVE-2026-111943 golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority
CVE-2026-111943 golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority
Go releases 1.27.3 and 1.26.10 address the following issue:
https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU
crypto/x509: mitigation for security concerns with a specific Certificate Authority
We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.
Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.
We highly recommend immediately upgrading to this release.
This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Vi
2026-10-21
Published