Bug 2556081

Summary:	CVE-2026-111943 golang: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Tomas Hoger <thoger>
Component:	golang	Assignee:	Alejandro Sáez Morollón <asm>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	amurdaca, asm, go-sig, jcajka
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["a751e0c3-4af3-4b2f-99b9-bb40bff0d536"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2556068

Description Tomas Hoger 2026-10-20 09:47:43 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Go releases 1.27.3 and 1.26.10 address the following issue:

https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU

crypto/x509: mitigation for security concerns with a specific Certificate Authority

We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.

Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.

We highly recommend immediately upgrading to this release.

This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.