Description
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
Published: 2026-10-21
Score: 6.8 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
References

Wed, 21 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Description Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse of certificate issued by the affected intermediate certificates. On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
Title golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority Distrust compromised intermediate certificates in crypto/x509
References

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Description Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority (CA), the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse of certificate issued by the affected intermediate certificates.
Title golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Weaknesses CWE-295
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:hummingbird:1
cpe:/o:redhat:enterprise_linux:10.2
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'}

threat_severity

Important

Subscriptions

Redhat Enterprise Linux Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-10-21T01:24:20.498Z

Reserved: 2026-10-17T13:43:28.599Z

Link: CVE-2026-111943

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-21T01:17:20.797

Modified: 2026-10-21T02:17:06.710

Link: CVE-2026-111943

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-20T02:00:00Z

Links: CVE-2026-111943 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-295

    Improper Certificate Validation