The Go team has changed crypto/x509 so that certificate chains containing a small set of distrusted intermediate certificates are rejected. It urges users to upgrade right away.
Go's crypto/x509 package will now filter out certificate chains that include a handful of intermediate certificates, citing specific security concerns about how they were operated. Verify no longer returns such chains to the caller. The change is tracked as CVE-2026-111943 and Go issue 82345, and the maintainers say they highly recommend upgrading immediately.
The issue's description does not name the certificate authority. However, the list of blocked public key hashes posted in the thread points to eight intermediates issued under eMudhra's emSign roots. Their subject names include DV, EV and OV TLS CAs labelled G3B and G3C, as well as OV CS CAs. Six chain up to emSign Root TLS CA – G3, and two to emSign Root CS CA – G3.
Backport issues were opened for Go 1.26 and Go 1.27, and separate changes were created for the main branch and both release branches. The issue was originally filed as an urgent security item, and its title was later changed to describe the mitigation more generally.
A commenter noted that, according to CCADB, all of these certificates were revoked for cACompromise on October 18-19, yet they had found no public news or reports about it. Another commenter said the committed patch should explain who and what each hash corresponds to. Several other participants reacted in agreement.
Source: Hacker News (front page)
