66pojuea Qek

groups.google.com • October 20, 2026

crypto/x509: mitigation for security concerns with a specific Certificate Authority We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation. Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller. We highly recommend immediately upgrading to this release. This is CVE-2026-111943 and Go issue .

crypto/x509: mitigation for security concerns with a specific Certificate Authority

We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.

Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.

We highly recommend immediately upgrading to this release.

This is CVE-2026-111943 and Go issue .

View the release notes for more information:

You can download binary and source distributions from the Go website:

To compile from source using a Git clone, update to the release with git checkout go1.27.3 and build as usual.

Thanks to everyone who contributed to the releases.

Cheers, Carlos and David for the Go team

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Go Blocks Eight CA Keys Due to Security Concerns On October 20, 2026, Go released versions 1.27.3 and 1.26.10, which block certificate chains containing eight intermediate certificate authority keys due to unspecified security concerns. The Go team has not disclosed the name of the affected certificate authority but stated that programs built on these versions will reject connections to sites using these keys. This action follows Mozilla's addition of six intermediate certificates from eMudhra's emSign Root TLS CA to its OneCRL list on October 17, 2026. The specific security issues prompting these actions remain undisclosed, and the Go team has not provided details on whether the blocking is intended to be permanent. The affected keys include various types of certificates issued by eMudhra, including domain validated and code signing certificates. Users are strongly advised to upgrade immediately to mitigate potential risks. The change is tracked as CVE-2026-111943. 2 sources 49

Extracted Entities

CVEs (1)

CVE-2026-111943

66pojuea Qek

The full story

Extracted Entities

CVEs (1)

Platforms (1)