CVE-2026-111943: Distrust compromised intermediate certificates in crypto/x509

Unscored severity · published Oct 21, 2026

CVE-2026-111943

Distrust compromised intermediate certificates in crypto/x509

–

CVSS

0.3%

EPSS

On KEV

Description

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 22% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

crypto/x509 · Go standard library

before 1.26.10; 1.27.0-0 before 1.27.3 · source: vendor

In the news

VulnerabilityCritical

How to Identify Compromised eMudhra Certificates With Qualys (CVE-2026-111943 and CVE-2026-111944)

Executive Summary A critical certificate authority incident disclosed on October 17, 2026, impacts eight eMudhra intermediate CA certificates. A flaw in the key generation process could allow attackers to recover private keys and issue fraudulent TLS or code-signing certificates. The affected intermediates have been revoked and blocked by major platform vendors, including Chrome, Mozilla, Apple, […]

CVE-2026-111943 CVE-2026-111944

Oct 24, 2026·Qualys Blog

Affected product

crypto/x509

Go standard library

All crypto/x509 CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-111943

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-111943

go.dev