On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Go standard library crypto/x509 unaffected
Version Status Constraints
0 affected < 1.26.10
1.27.0-0 affected < 1.27.3

No data.

Package CPE Advisory Released Date
Red Hat Enterprise Linux 10
golang-0:1.26.10-1.el10_2 cpe:/o:redhat:enterprise_linux:10.2 RHSA-2026:86093 2026-10-20T00:00:00Z
Red Hat Enterprise Linux 8
go-toolset:rhel8-8100020261020054335.a3795dee cpe:/a:redhat:enterprise_linux:8 RHSA-2026:86203 2026-10-20T00:00:00Z
Red Hat Hardened Images
golang1-26-main-1.26.10-0.1.hum1 cpe:/a:redhat:hummingbird:1 RHSA-2026:85899 2026-10-20T00:00:00Z
golang1-27-main-1.27.3-1.hum1 cpe:/a:redhat:hummingbird:1 RHSA-2026:86029 2026-10-20T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Redhat Subscribe
Enterprise Linux Subscribe
Hummingbird Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://www.openwall.com/lists/oss-security/2026/10/20/29 cve-icon
https://github.com/golang/go/issues/82345 cve-icon
https://go.dev/cl/851047 cve-icon cve-icon
https://go.dev/issue/82345 cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/66pojueaQek cve-icon cve-icon
https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-111943 cve-icon
https://pkg.go.dev/vuln/GO-2026-6809 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-111943 cve-icon
History

Wed, 21 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
References

Wed, 21 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Description Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse of certificate issued by the affected intermediate certificates. On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
Title golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority Distrust compromised intermediate certificates in crypto/x509
References

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Description Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse of certificate issued by the affected intermediate certificates.
Title golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Weaknesses CWE-295
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:hummingbird:1
cpe:/o:redhat:enterprise_linux:10.2
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'}

threat_severity

Important

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-10-21T01:24:20.498Z

Reserved: 2026-10-17T13:43:28.599Z

Link: CVE-2026-111943

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-21T01:17:20.797

Modified: 2026-10-21T02:17:06.710

Link: CVE-2026-111943

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-20T02:00:00Z

Links: CVE-2026-111943 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses