# Go Language Implements Security Patch for Distrusted Certificate Authorities Go 1.28 update mitigates CVE-2026-111943 by blocking eight compromised intermediate certificate chains. - **Source:** [Hacker News: Front Page](https://brifing.si/source/b07aa772-b1a0-4a76-aa18-719c6f9e2dde) - **Published:** 2026-10-20 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/54a22444-e3cc-4956-975b-a8f00307da02 ## Urgent Security Mitigation The Go development team released a critical update to address CVE-2026-111943, which involves security concerns regarding specific Certificate Authorities. This patch explicitly blocks trust in eight intermediate certificates. Developers are strongly advised to upgrade their environments immediately to ensure that these compromised chains are no longer accepted by the crypto/x509 package. ## Scope of the Revocation The revoked certificates include various EM DV, EV, and OV TLS and CS CA variants issued by eMudhra. These specific intermediates were identified as compromised between October 18 and October 19, 2026, according to CCADB data. The Go runtime now filters these out, preventing them from being returned to any calling application. ## Patch Deployment Strategy The fix was integrated into the Go 1.28 milestone and backported to versions 1.26 and 1.27. Specifically, patches were applied to release branches for Go 1.26.10 and 1.27.3. Automated bots managed the cherry-picking process, ensuring that the security mitigation reached multiple supported versions of the language runtime simultaneously across various production environments. ## Technical Implementation Details The mitigation works by modifying the crypto/x509 package to filter out certificate chains containing the identified Subject Public Key Information (SPKI). By checking these chains at the library level, the Go runtime prevents the validation of potentially malicious certificates. This proactive approach stops compromised chains from being accepted during standard TLS handshakes. ## Operational Impact Analysis Systems relying on these specific eMudhra intermediate certificates will experience immediate validation failures upon upgrading to the patched Go versions. Developers must verify their certificate chains against the list of distrusted SPKIs to avoid service disruptions. This change enforces stricter trust boundaries by removing reliance on entities that have suffered a compromise. ## Tracking and Transparency The issue was tracked under the internal identifier b/575512169 and publicly documented as Go issue 82345. While the technical implementation is clear, community members noted a lack of public reports detailing the specific nature of the compromise. The patch remains focused on the immediate technical removal of trust for the affected entities. ## Supply Chain Security This incident highlights the importance of rapid response in language-level security. By embedding the revocation directly into the standard library, Go maintainers ensure that all downstream applications inherit the protection. This mechanism is essential for mitigating risks where intermediate CAs are compromised, protecting the broader ecosystem from potential man-in-the-middle attack vectors. ## Future Maintenance Considerations The rapid backporting to Go 1.26 and 1.27 demonstrates the project's commitment to maintaining security across older, stable releases. Organizations should monitor the Go release wiki for minor updates to ensure they remain protected against similar vulnerabilities. Future updates will likely continue to refine how the crypto/x509 package handles distrusted certificate chains. ## Sources covering this story - https://github.com/golang/go/issues/82345 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._