CVE-2026-111943

CVE-2026-111943 is a vulnerability in the Go programming language's `crypto/x509` certificate verification package. The issue arose following the compromise of eight intermediate Certificate Authority (CA) private keys belonging to eMudhra. Due to a key generation flaw that resulted in weak cryptographic keys with low entropy, researchers were able to recover the private keys for these intermediate certificates. Because many Go applications and static container environments rely on certificate stores that do not immediately process certificate revocations, they could continue to trust certificate chains derived from these compromised keys. An attacker who possesses the private keys of the compromised intermediate CAs could generate fraudulent TLS or code-signing certificates. This would allow them to impersonate legitimate websites or services and conduct man-in-the-middle (MitM) attacks to intercept or alter secure network communications. To mitigate this issue, the Go team released Go versions 1.27.3 and 1.26.10, which implement an explicit denylist that filters out and rejects certificate chains containing the SHA-256 hashes of the SubjectPublicKeyInfo (SPKI) for the compromised eMudhra intermediate certificates.