Описание
Go: CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509
FAQ
Where can I find information about this third-party CVE?
See the Go security advisory and the CVE-2026-111943 record for information about this vulnerability. The NVD entry provides additional tracking information. For background on how Microsoft documents partner-assigned CVEs, see Security Update Guide Supports CVEs Assigned by Industry Partners.
Возможность эксплуатации
Publicly Disclosed
Exploited
EPSS
7.4 High
CVSS3
Связанные уязвимости
(On most platforms, Go uses the given system root certificates. However ...)
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
On most platforms, Go uses the given system root certificates. However ...
EPSS
7.4 High
CVSS3