CVE-2026-111943

Awaiting Analysis Awaiting Analysis - Queue

Go Denylist Bypass in crypto/x509 Certificate Verification

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Go Project

Description

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-111943

EUVD

EUVD-2026-106926

Affected Vendors & Products

Vendor	Product	Version / Range
Go standard library	crypto/x509	0
Go standard library	crypto/x509	1.27.0-0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-299	The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Go standard library's crypto/x509 package. It involves a denylist added to the Certificate.Verify function to reject known untrustworthy intermediate certificates during certificate verification. This addresses cases where system trust stores may not update automatically.

Detection Guidance

To detect this vulnerability, check your Go version using the command: go version. If your version is below 1.26.10 or between 1.27.0 and 1.27.2, your system is affected. Affected versions do not automatically filter untrustworthy intermediate certificates in crypto/x509.

Impact Analysis

If you use Go versions before 1.26.10 or from 1.27.0 to 1.27.2, your application may trust compromised intermediate certificates. This could allow attackers to intercept or manipulate encrypted communications by presenting fraudulent certificates.

Compliance Impact

The vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves distrusting specific intermediate certificates in Go's crypto/x509 package to prevent security risks. Compliance impacts would depend on how the affected certificates were used in systems subject to these regulations.

Mitigation Strategies

Upgrade Go to version 1.26.10, 1.27.3, or 1.28 or later immediately. Use the command: go install golang.org/dl/go1.27.3@latest followed by go1.27.3 download. Alternatively, download the latest version from https://go.dev/dl/.

Hi! I’m here to help you understand CVE-2026-111943. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...