2556068 – (CVE-2026-111943) CVE-2026-111943 golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority

Bug 2556068 (CVE-2026-111943) - CVE-2026-111943 golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority

Summary: CVE-2026-111943 golang: crypto/x509: Go: crypto/x509: mitigation for security...

Keywords:
Status:	NEW
Alias:	CVE-2026-111943
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	high
Severity:	high
Target Milestone:	---
Assignee:	Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:	2556081
Blocks:
TreeView+	depends on / blocked

Reported:	2026-10-20 09:43 UTC by OSIDB Bzimport
Modified:	2026-10-20 22:53 UTC (History)
CC List:	3 users (show)
Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2026:86093	None	None	None	2026-10-20 20:27:12 UTC
Red Hat Product Errata	RHSA-2026:86196	None	None	None	2026-10-20 22:53:50 UTC
Red Hat Product Errata	RHSA-2026:86203	None	None	None	2026-10-20 21:57:53 UTC

Description OSIDB Bzimport 2026-10-20 09:43:11 UTC

Go releases 1.27.3 and 1.26.10 address the following issue:

https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU

crypto/x509: mitigation for security concerns with a specific Certificate Authority

We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.

Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.

We highly recommend immediately upgrading to this release.

This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.

Comment 2 Jon Orris 2026-10-20 20:27:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:86093 https://access.redhat.com/errata/RHSA-2026:86093

Comment 3 Jon Orris 2026-10-20 21:57:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:86203 https://access.redhat.com/errata/RHSA-2026:86203

Comment 4 Jon Orris 2026-10-20 22:53:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:86196 https://access.redhat.com/errata/RHSA-2026:86196

Note You need to log in before you can comment on or make changes to this bug.