CVE-2026-111943

CVE Enrichment

CISA KEV: Not listed

Description

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

Technical Details

CNA / NVD Source: [email protected]
Published: 21-Oct-2026 08:17
Last Modified: 21-Oct-2026 09:17

References

Last enrichment sync: 21-Oct-2026 11:58
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (5)

The eMudhra certificate authority incident is tracked as CVE-2026-111943 in Go and related ecosystem projects. Sonatype Details Product Impact From eMudhra CA Key-Generation Flaw
The Go Project responded by introducing CVE-2026-111943, which addresses cases where Go applications could continue trusting certificate chains containing the compromised intermediates. Go Blocks Compromised eMudhra Certificate Authorities in CVE-2026-111943
their operation" and "highly recommending" upgrading to a new version. The issue is being tracked as CVE-2026-111943 within the Go ecosystem. One-Byte eMudhra Certificate Keys Trigger Revocations and Software Updates
| CVE ID | None for the CA incident itself; downstream fixes tracked as CVE-2026-111943 (Go crypto/x509) and CVE-2026-113470 (Firefox OneCRL block list) | Weak eMudhra CA Keys Exposed for 17 Months; Browser Blocks Deployed
The Go development team released versions 1.27.3 and 1.26.10 to address the issue, tracked as CVE-2026-111943. Weak eMudhra Certificate Keys Prompt Browser Blocks and Software Updates

CVE (1)

People (5)

Vendors (8)

Products (20)

Tools (1)

Industries (2)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.