6.8
Medium
CVE-2026-111943 On most platforms, Go uses the given system root certificates
Description
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| crypto/x509 1.27 | 1.27.0-0 → < 1.27.3 | 1.27.3 |
| crypto/x509 1.26 | earliest → < 1.26.10 | 1.26.10 |
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of crypto/x509
The 15 CVEs of crypto/x509 →
CVE-2026-27145
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name…
6.5
Medium
CVE-2026-32280
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate…
7.5
High
CVE-2026-32281
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a…
7.5
High
CVE-2026-33810
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to…
7.5
High