Go will reject certificate chains containing eight distrusted SPKIs
The Go programming language team has released a security update to address CVE-2026-111943 by distrusting a specific set of intermediate certificate authorities. This update prevents the crypto/x509 library from accepting certificate chains containing these compromised intermediates.
Why it matters
This is a critical security patch for developers using Go, as failing to update could leave applications vulnerable to man-in-the-middle attacks or invalid certificate validation.
Code Issues 5k+ ( 5k+ ) Pull requests 593 ( 593 ) Discussions Actions Projects Wiki Security and quality Insights More items crypto/x509: mitigation for security concerns with a specific Certificate Authority #82345 New issue Copy link New issue Copy link Closed Closed crypto/x509: mitigation for security concerns with a specific Certificate Authority #82345 Copy link Labels Security release-blocker Milestone Go1.28 Description thatnealpatel opened on Oct 19, 2026 Issue body actions We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.
Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.
We highly recommend immediately upgrading to this release.
This is CVE-2026-111943 and Go issue https://go.dev/issue/82345 .
This was an URGENT track issue originally tracked in http://b/575512169 .
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in