Executive Summary
On 19–20 October 2026 the Go team released versions 1.27.3 and 1.26.10 containing a single high-priority security fix. The change, tracked as CVE-2026-111943 and handled on Go's URGENT track, causes the crypto/x509 package to reject any certificate chain that contains one of eight specific intermediate certificate authority public keys.
The Go team stated only that the keys belong to a certificate authority with "specific security concerns around their operation" and recommended immediate upgrades. Independent analysis of the hard-coded SHA-256 SubjectPublicKeyInfo (SPKI) hashes in the source has linked all eight to intermediates issued by eMudhra under the emSign Root TLS CA - G3 and emSign Root CS CA - G3 hierarchies. These include domain-validated, organization-validated, and extended-validation TLS intermediates as well as organization-validated code-signing intermediates operated by eMudhra BV (Netherlands) and eMudhra Inc (United States).
| Field | Detail |
|---|---|
| CVE | CVE-2026-111943 |
| Fixed versions | Go 1.27.3, Go 1.26.10 |
| Affected component | crypto/x509 |
| Failure mode | x509: no valid chains built |
| Mitigation | Rebuild against the patched toolchain after validating dependencies |
What the Fix Does
The filter is hard-coded and cannot be disabled. It applies even when an application supplies its own set of trusted roots. Consequently, any program rebuilt with the new Go versions will refuse TLS (or other x509) connections whose chains pass through the blocked intermediates, returning:
x509: no valid chains built
The change does not affect already-deployed binaries until they are rebuilt.
A Coordinated Distrust Action
The Go update follows related distrust actions:
- Mozilla added six of the intermediates to OneCRL in mid-October.
- The certificates were revoked in the Common CA Database with the reason code cACompromise on 18–19 October.
- Public details of the underlying incident remain limited.
Broader ecosystem effects are still emerging, as other trust stores and language runtimes evaluate similar measures.
Impact
Organizations that rebuild Go applications, containers, or binaries after upgrading the toolchain risk sudden connection failures to services that still rely on certificates issued under the affected eMudhra intermediates. Because the rejection is unconditional, a single blocked intermediate anywhere in a chain is enough to break the handshake — including chains to partner or third-party endpoints outside your control.
The blast radius is therefore determined by rebuild timing, not by whether an application is "vulnerable" in the traditional sense. CI pipelines that pull the latest Go image will pick up the change automatically, while long-lived production binaries will not.
Indicators of Compromise: Distrusted SPKI Hashes
The following SHA-256 hashes of SubjectPublicKeyInfo are blocked by Go 1.27.3 / 1.26.10 and later:
ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105
49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f
e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41
5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0
43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b
63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8
ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6
92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30
Recommendations
- Upgrade the Go toolchain to 1.27.3 or 1.26.10 (or later) and rebuild affected applications and container images.
- Test rebuilt binaries in staging against critical external services before production deployment.
- Monitor for TLS handshake failures mentioning no valid certificate chains.
- Review any internal or partner services that may still depend on certificates issued by the affected eMudhra intermediates and plan migrations if necessary.
- Track additional distrust announcements from other root programs and language ecosystems.
References
- Official announcement: https://groups.google.com/g/golang-announce/c/66pojueaQek
- Go issue: https://go.dev/issue/82345
- CVE-2026-111943
- Release notes: https://go.dev/doc/devel/release#go1.27.3
Keep pace with trust-store and supply-chain changes like this with the Threat Landscape Platform — curated advisories, IoC feeds, and an AI Assistant for instant answers. Start free, no credit card required.