Repository navigation
crypto/x509: mitigation for security concerns with a specific Certificate Authority #82345
Description
We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.
Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.
We highly recommend immediately upgrading to this release.
This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.
This was an URGENT track issue originally tracked in http://b/575512169.
Activity
thatnealpatel commentedon Oct 19, 2026
@gopherbot Please open backports for this issue.
gopherbot commentedon Oct 19, 2026
Backport issue(s) opened: #82348 (for 1.26), #82349 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
[release-branch.go1.26] crypto/x509: distrust a handful of intermediates
[release-branch.go1.27] crypto/x509: distrust a handful of intermediates
gopherbot commentedon Oct 20, 2026
Change https://go.dev/cl/851165 mentions this issue:
[release-branch.go1.27] crypto/x509: distrust a handful of intermediatesgopherbot commentedon Oct 20, 2026
Change https://go.dev/cl/851145 mentions this issue:
[release-branch.go1.26] crypto/x509: distrust a handful of intermediatesgopherbot commentedon Oct 20, 2026
Change https://go.dev/cl/851047 mentions this issue:
crypto/x509: distrust a handful of intermediates[-]security: fix CVE-2026-111943[/-][+]crypto/x509: mitigation for security concerns with a specific Certificate Authority[/+]crypto/x509: distrust a handful of intermediates
external/go: Update to go1.27.3
external/go: Update to go1.27.3
47 remaining items
Update Go to 1.27.3
fix(deps): bump Go toolchain to 1.27.3 for crypto/x509 CA distrust
fix(build): Build releases with Go 1.26.10 for CVE-2026-111943
security: Bump Go to 1.26.10
Build with Go 1.26.10 and drop compromised emSign roots (eMudhra, CVE…
chore: Bump default Credex app version to latest
chore: Bump default observer app version to latest
chore: Bump default server and agent images (#45)
gopherbot commentedon Oct 21, 2026
Change https://go.dev/cl/852085 mentions this issue:
crypto/x509: document reason for custom distrustchore(deps): revert Go to 1.26.10
chore(deps): revert Go to 1.26.10
chore(deps): revert Go to 1.26.10
tls: reject chains containing blocked public keys
fix(go): build with Go 1.26.10 (CVE-2026-111943) (#640)
gopherbot commentedon Oct 22, 2026
Change https://go.dev/cl/852605 mentions this issue:
ragserver: update Weaviate image in tests to 1.39.13