Back News.Ycombinator

Go will reject certificate chains containing eight distrusted SPKIs

News.Ycombinator • October 20, 2026

We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.

Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.

We highly recommend immediately upgrading to this release.

This is CVE-2026-111943 and Go issue .

This was an URGENT track issue originally tracked in .

thatnealpatel added this to the Go1.28 milestone on Oct 19, 2026

thatnealpatel added Security release-blocker on Oct 19, 2026

gopherbot added 2 commits that reference this issue on Oct 20, 2026 [release-branch.go1.26] crypto/x509: distrust a handful of intermediates aa64342 [release-branch.go1.27] crypto/x509: distrust a handful of intermediates 90617fb

[release-branch.go1.26] crypto/x509: distrust a handful of intermediates

[release-branch.go1.27] crypto/x509: distrust a handful of intermediates

thatnealpatel changed the title [-] security: fix CVE-2026-111943 [/-] [+] crypto/x509: mitigation for security concerns with a specific Certificate Authority [/+] on Oct 20, 2026

gopherbot added a commit that references this issue on Oct 20, 2026 crypto/x509: distrust a handful of intermediates 7f86f95

crypto/x509: distrust a handful of intermediates

thatnealpatel closed this as completed on Oct 20, 2026

chenxiaolong added 2 commits that reference this issue on Oct 20, 2026 external/go: Update to go1.27.3 0e623cf external/go: Update to go1.27.3 06bfbc8

external/go: Update to go1.27.3

stefanb added a commit that references this issue on Oct 20, 2026 Bump Go from 1.27.2 to 1.27.3 for CVE-2026-111943 ( #347 ) 38dab69

Bump Go from 1.27.2 to 1.27.3 for CVE-2026-111943 ( #347 )

amckinley added 3 commits that reference this issue on Oct 20, 2026 Build with Go 1.26.10 for CVE-2026-111943 ( #1 ) de12863 build: Go 1.26.10 for CVE-2026-111943 ( #1517 ) bdacece Build with Go 1.26.10 for CVE-2026-111943 ( #14 ) ae4c2cf

Build with Go 1.26.10 for CVE-2026-111943 ( #1 )

build: Go 1.26.10 for CVE-2026-111943 ( #1517 )

Build with Go 1.26.10 for CVE-2026-111943 ( #14 )

CaffeeLake added a commit that references this issue on Oct 20, 2026 build: Go 1.26.10 for CVE-2026-111943 8f25ee5

build: Go 1.26.10 for CVE-2026-111943

UmanShahzad added 2 commits that reference this issue on Oct 20, 2026 Build on Go 1.27.3, which distrusts a handful of intermediates 0755697 Build on Go 1.27.3, which distrusts a handful of intermediates 1f1670c

Build on Go 1.27.3, which distrusts a handful of intermediates

UlisesGascon added a commit that references this issue on Oct 20, 2026 tls: reject chains containing blocked public keys 577a4a9

tls: reject chains containing blocked public keys

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Go Blocks Eight CA Keys Due to Security Concerns On October 20, 2026, Go released versions 1.27.3 and 1.26.10, which block certificate chains containing eight intermediate certificate authority keys due to unspecified security concerns. The Go team has not disclosed the name of the affected certificate authority but stated that programs built on these versions will reject connections to sites using these keys. This action follows Mozilla's addition of six intermediate certificates from eMudhra's emSign Root TLS CA to its OneCRL list on October 17, 2026. The specific security issues prompting these actions remain undisclosed, and the Go team has not provided details on whether the blocking is intended to be permanent. The affected keys include various types of certificates issued by eMudhra, including domain validated and code signing certificates. Users are strongly advised to upgrade immediately to mitigate potential risks. The change is tracked as CVE-2026-111943. 2 sources 49

Extracted Entities

CVEs (1)

CVE-2026-111943