Bug 2556081 - CVE-2026-111943 golang: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority [fedora-all]
Summary: CVE-2026-111943 golang: Go: crypto/x509: mitigation for security concerns wit...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: golang
Version: rawhide
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Alejandro Sáez Morollón
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["a751e0c3-4af3-4b2f-99b9-b...
Depends On:
Blocks: CVE-2026-111943
TreeView+ depends on / blocked
 
Reported: 2026-10-20 09:47 UTC by Tomas Hoger
Modified: 2026-10-20 09:47 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Tomas Hoger 2026-10-20 09:47:43 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Go releases 1.27.3 and 1.26.10 address the following issue:

https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU

crypto/x509: mitigation for security concerns with a specific Certificate Authority

We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.

Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.

We highly recommend immediately upgrading to this release.

This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.
Note You need to log in before you can comment on or make changes to this bug.