Skip to content
Go Blocks Eight CA Keys Due to Security Concerns

Go Blocks Eight CA Keys Due to Security Concerns

First seen 20 Oct 2026, 14:19 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 14:49 UTC
  • •Go has blocked eight intermediate CA keys due to security concerns.
  • •Users must upgrade to Go versions 1.27.3 or 1.26.10 to avoid connection issues.
  • •The specific security issues prompting the block remain undisclosed.

On October 20, 2026, Go released versions 1.27.3 and 1.26.10, which block certificate chains containing eight intermediate certificate authority keys due to unspecified security concerns. The Go team has not disclosed the name of the affected certificate authority but stated that programs built on these versions will reject connections to sites using these keys. This action follows Mozilla's addition of six intermediate certificates from eMudhra's emSign Root TLS CA to its OneCRL list on October 17, 2026. The specific security issues prompting these actions remain undisclosed, and the Go team has not provided details on whether the blocking is intended to be permanent. The affected keys include various types of certificates issued by eMudhra, including domain validated and code signing certificates. Users are strongly advised to upgrade immediately to mitigate potential risks. The change is tracked as CVE-2026-111943.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-17
Mozilla adds six eMudhra certificates to OneCRL
Mozilla blocked six intermediate certificates from eMudhra's emSign Root TLS CA due to security concerns.
The Hacker News
2026-10-20
Go releases updates blocking CA keys
Go released versions 1.27.3 and 1.26.10, which block eight intermediate CA keys due to unspecified security concerns.
The Hacker News

More articles in this cluster (3)

Following this threat?

Track eMudhra and CVE-2026-111943 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 2

Common questions

Which versions of Go are affected?
Versions prior to 1.27.3 and 1.26.10 are affected as they do not block the eight CA keys.
What should I do if I use Go?
You should upgrade to Go versions 1.27.3 or 1.26.10 immediately to avoid connection issues.
Are there any known exploits for this issue?
No, there are currently no known exploits; the issue is disclosed and patched.