Skip to content
Fencer Vulns
medium 6.8

CVE-2026-111943 json

Distrust compromised intermediate certificates in crypto/x509

published 2026-10-19 20 d ago modified 2026-10-30 9 d ago also BIT-golang-2026-111943 , EUVD-2026-106926 , GO-2026-6809 , RUSTSEC-2026-0381 , RUSTSEC-2026-0382 , RUSTSEC-2026-0383

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

Patch / fix

  • bitnami golang 1.26.10, 1.27.3
  • go stdlib 1.26.10, 1.27.3
  • crates.io webpki-roots 0.26.11, 1.0.10
  • crates.io rustls-webpki 0.103.16, 0.104.0-alpha.8
  • crates.io webpki-root-certs 0.26.11, 1.0.10
  • Go standard library crypto/x509 1.26.10, 1.27.3
  • golang-1.26 Debian 14 1.26.10-1
  • golang-1.27 Debian 14 1.27.3-1

debian advisories DEBIAN-CVE-2026-111943

  • go1.26-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.26.10-150000.1.21.2
  • go1.26-openssl SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Development Tools 15 SP7 1.26.10-150600.13.18.1
  • go1.26 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.26.10-150000.1.36.1
  • go1.27 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.27.3-150000.1.15.1
  • go1.27 SLES for SAP applications 16.0, SLES 16.0 1.27.3-160000.1.1
  • go1.26 SLES for SAP applications 16.0, SLES 16.0 1.26.10-160000.1.1

suse advisories SUSE-SU-2026:4867-1SUSE-SU-2026:4866-1SUSE-SU-2026:4864-1SUSE-SU-2026:4863-1SUSE-SU-2026:24360-1SUSE-SU-2026:24359-1

  • golang-github-prometheus-alertmanager openSUSE Tumbleweed 0.34.2-1.1
  • nova openSUSE Tumbleweed 3.12.3-1.1
  • pluto openSUSE Tumbleweed 5.24.5-1.1
  • polaris openSUSE Tumbleweed 10.2.6-1.1
  • bugwarden openSUSE Tumbleweed 0.7.0-1.1
  • diun openSUSE Tumbleweed 4.33.1-1.1
  • versitygw openSUSE Tumbleweed 1.10.0-1.1
  • fleet-cli openSUSE Tumbleweed 0.16.3-1.1

opensuse advisories openSUSE-SU-2026:12455-1openSUSE-SU-2026:12464-1openSUSE-SU-2026:12470-1openSUSE-SU-2026:12471-1openSUSE-SU-2026:12385-1openSUSE-SU-2026:12360-1

  • delve AlmaLinux 9 1.26.1-2.el9_8
  • delve AlmaLinux 10 1.26.1-3.el10_2
  • delve AlmaLinux 8 1.26.1-2.module_el8.10.0+4353+8cb525cc
  • golang AlmaLinux 8 1.26.10-1.module_el8.10.0+4307+6e4cbc60
  • go-toolset AlmaLinux 8 1.26.10-1.module_el8.10.0+4307+6e4cbc60
  • golang-bin AlmaLinux 8 1.26.10-1.module_el8.10.0+4307+6e4cbc60
  • golang-src AlmaLinux 8 1.26.10-1.module_el8.10.0+4307+6e4cbc60
  • golang-misc AlmaLinux 8 1.26.10-1.module_el8.10.0+4307+6e4cbc60

almalinux advisories ALSA-2026:95518ALSA-2026:95519ALSA-2026:95638ALSA-2026:93596ALSA-2026:93617ALSA-2026:91719

  • delve Rocky Linux 10 1.26.1-3.el10_2
  • delve Rocky Linux 9 1.26.1-2.el9_8
  • delve Rocky Linux 8 1.26.1-2.module+el8.10.0+40408+b9bc4117
  • golang Rocky Linux 8 1.26.10-1.module+el8.10.0+40387+102242d5
  • opentelemetry-collector Rocky Linux 10 0.158.0-2.el10_2
  • opentelemetry-collector Rocky Linux 9 0.158.0-2.el9_8
  • ignition Rocky Linux 9 2.26.0-1.el9_8.2
  • ignition Rocky Linux 10 2.26.0-3.el10_2.4

rocky linux advisories RLSA-2026:95519RLSA-2026:95518RLSA-2026:95638RLSA-2026:93596RLSA-2026:93617RLSA-2026:91719

  • go Alpine 3.24 1.26.10-r0
  • docker Alpine 3.24 29.9.2-r0
  • docker-cli-buildx Alpine 3.24 0.38.1-r0
  • docker-cli-compose Alpine 3.24 5.6.1-r0

alpine advisories ALPINE-CVE-2026-111943

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-111943 updated cvss 6.8

crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

  • Red Hat Ansible Automation Orchestrator 2026 ansible-automation-platform/automation-orchestrator-rhel9-operator, ansible-automation-platform/automation-orchestrator-temporal-rhel9, ansible-automation-platform/automation-orchestrator-operator-bundle Red Hat Exploit Intelligence exploit-intelligence/exploit-intelligence-operator-controller-rhel9 Red Hat OpenShift Developer Tools and Services helm 3.22.0-90.el9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-opc-rhel9, openshift-pipelines/pipelines-cache-rhel9, openshift-pipelines-client 1.15.3-11580.el8, openshift-pipelines/pipelines-cli-tkn-rhel8, openshift-pipelines/pipelines-cli-tkn-rhel9, openshift-pipelines/pipelines-rhel9-operator, +21 more Red Hat OpenShift Serverless kn-workflow-plugin 1.38.1-1.el9, openshift-serverless-clients 1.17.0-4.el9 Red Hat OpenShift Service Mesh 3 istio-proxy-selinux, istio-proxy 1.30.5-1.el9, openshift-golang-builder-container
    +13 more products
    Red Hat Ansible Automation Platform 2 ansible-on-clouds/aoc-azure-aap-installer-rhel9, ansible-automation-platform/platform-operator-bundle Red Hat Build of Podman Desktop podman Red Hat Ceph Storage 7 thrift Red Hat Ceph Storage 8 thrift, thrift-qt, perl-thrift, thrift-glib, python3-thrift Red Hat Ceph Storage 9 thrift, libarrow, parquet-libs Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-cnf 9.0-20240522.1.el9, redhat-certification-preflight 9.42-20261005.el10 Red Hat Developer Hub 2 rhdh/rhdh-rhel9-operator Red Hat Edge Manager 1 flightctl 1.3.1-1.el10 Red Hat Enterprise Linux 7 rhc, host-metering, rhc-worker-script, host-metering-selinux Red Hat Enterprise Linux 8 git-lfs, osbuild-composer, osbuild-composer-core, osbuild-composer-worker, git-lfs 3.7.1-5.el10_2.7, osbuild-composer-dnf-json, +1 more Red Hat Enterprise Linux 9 crun, runc, git-lfs, toolbox, image-builder, toolbox-tests, +12 more Red Hat Enterprise Linux 10 crun, toolbox, oci-delta 0.3.0-1.el10, git-lfs 3.7.1-5.el10_2.7, image-builder 52.1-2.el10_2, go-fdo-client 1.0.0-4.el10_2.7, +4 more Red Hat Enterprise Linux AI (RHEL AI) 3 golang
    affected: workaround, no fix available “See the security bulletin for a detailed mitigation procedure.”
  • Red Hat Hardened Images golang1.25 1.25.14-0.1.hum1
    affected: workaround, no fix planned “See the security bulletin for a detailed mitigation procedure.”
  • Red Hat OpenShift AI (RHOAI) rhoai/rhai-cli-rhel9, rhoai/odh-trainer-rhel9, rhoai/odh-core-bff-rhel9, rhoai/odh-eval-hub-rhel9, rhoai/odh-maas-api-rhel9, rhoai/odh-rhel9-operator, +76 more
    affected: workaround, no fix available, no fix planned “See the security bulletin for a detailed mitigation procedure.”
  • Red Hat OpenShift Container Platform 4 podman, toolbox, podman-tests, podman-docker, podman-remote, podman-gvproxy, +5 more Red Hat OpenShift Container Platform 5 kata-containers, cri-tools 1.35.0-3.el10, cri-o 1.35.9-11.rhaos4.22.git4c168db.el10, openshift 4.22.0-202609220430.p2.g9858a61.assembly.stream.el10, microshift 4.22.19-202610190036.p0.g1a5c987.assembly.4.22.19.el9, openshift-clients 4.22.0-202609170632.p2.gd0f23b1.assembly.stream.el10, +4 more Red Hat OpenShift for Windows Containers openshift4-wincw/windows-machine-config-operator-bundle Red Hat OpenShift on AWS rosa 1.2.64-b2f7c89.el8 Red Hat OpenShift Virtualization 4 openshift-golang-builder-container Red Hat OpenStack Platform 16.2 golang-github-infrawatch-apputils 0.5-3.git4ffa970.el8ost
    +5 more products
    Red Hat OpenStack Platform 17.1 golang-github-infrawatch-apputils 0.5-3.git4ffa970.el8ost Red Hat OpenStack Platform 18.0 rhoso-operators/placement-rhel9-operator, rhoso-operators/rabbitmq-cluster-rhel9-operator Red Hat Service Interconnect 1 skupper-cli 1.8.8-1.el9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal-rhel9-operator Red Hat streams for Apache Kafka 3 golang-github-danielqsj-kafka_exporter 1.9.0-12.el9
    affected: workaround, no fix available “See the security bulletin for a detailed mitigation procedure.”
  • Red Hat CodeReady Linux Builder EUS (v.9.6) rhc-devel 0.2.7-1.el9_6.8, rhc-debuginfo 0.2.7-1.el9_6.8, rhc-debugsource 0.2.7-1.el9_6.8
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:89914
  • Red Hat Developer Hub 1.9 rhdh/rhdh-rhel9-operator 1793117972
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:91651
  • Red Hat Enterprise Linux AppStream (v. 8) rhc 0.2.5-13.el8_10, grafana 9.2.10-36.el8_10, grafana-pcp 5.1.1-19.el8_10, grafana-selinux 9.2.10-36.el8_10, crit 3.18-5.module+el8.10.0+25171+d379b437, criu 3.18-5.module+el8.10.0+25171+d379b437, +40 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:89760
  • Red Hat Enterprise Linux AppStream (v. 9) rhc 0.2.7-16.el9_8, delve 1.26.1-2.el9_8, podman 5.8.2-8.el9_8, skopeo 1.22.2-9.el9_8, buildah 1.43.4-2.el9_8, golang 1.26.10-1.el9_8, +20 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:90424
show 4 more
  • Red Hat Enterprise Linux AppStream (v. 10) rhc 0.3.8-8.el10_2, delve 1.26.1-3.el10_2, podman 5.8.2-11.el10_2, skopeo 1.22.2-6.el10_2, buildah 1.43.1-7.el10_2, golang 1.26.10-1.el10_2, +21 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88262
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) rhc 0.2.0-6.el8_4.2, git-lfs 2.13.3-3.el8_4.6, delve 1.26.1-1.module+el8.4.0+25181+7ce5b91c, golang 1.26.10-2.module+el8.4.0+25201+9a419e96, go-toolset 1.26.10-2.module+el8.4.0+25201+9a419e96, golang-bin 1.26.10-2.module+el8.4.0+25201+9a419e96, +4 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:90994
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) rhc 0.2.1-14.el8_6.1, grafana 7.5.11-12.el8_6, git-lfs 2.13.3-3.el8_6.9, grafana-pcp 3.2.0-4.el8_6.2, osbuild-composer 46.3-11.el8_6, osbuild-composer-core 46.3-11.el8_6, +10 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:87246
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) rhc 0.2.2-1.el8_8.3, git-lfs 3.2.0-2.el8_8.9, grafana 7.5.15-12.el8_8, grafana-pcp 3.2.0-6.el8_8.2, osbuild-composer 75-12.el8_8, osbuild-composer-core 75-12.el8_8, +10 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:87245

42 more fixed, 41 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
9 d ago

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.26.10
>=1.27.0-0, <1.27.3
1.26.10
1.27.3
go stdlib
<1.26.10
>=1.27.0-0, <1.27.3
1.26.10
1.27.3
crates.io webpki-roots
>=0.0.0-0, <0.26.11
>=0.26.12-0, <1.0.10
0.26.11
1.0.10
crates.io rustls-webpki
>=0.0.0-0, <0.103.16
>=0.104.0-alpha.1, <0.104.0-alpha.8
0.103.16
0.104.0-alpha.8
crates.io webpki-root-certs
>=0.0.0-0, <0.26.11
>=0.26.12-0, <1.0.10
0.26.11
1.0.10

Affected products

  • Go standard library crypto/x509

Classification

Weakness
  • CWE-299 Improper Check for Certificate Revocation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.