Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Unknown | n/a | CVE-2026-111943 |
On most platforms, Go uses the given system root certificates
Go standard library, GoGo standard library crypto/x509, Go, Go crypto/x509
|
NVD | |||
|
CVE-2026-111943On most platforms, Go uses the given system root certificates
Executive summaryThe Go programming language's crypto/x509 package is affected by a mitigation for security concerns with a specific set of intermediate certificates from a Certificate Authority. The advisory says the fix blocks trust in these intermediates, and it strongly recommends upgrading immediately to the fixed Go release. Technical summaryThe advisory describes distrust of a small set of intermediate certificates whose operation raised security concerns, implemented in crypto/x509 by filtering out chains that contain these intermediates during verification. The vulnerability class, attack vector, and preconditions are not stated. Affected Go versions are not explicitly listed in the advisory text, though backport issues reference Go 1.26 and Go 1.27 release branches, and the fixed release is referred to as Go 1.27.3 and Go 1.26.10 in linked commits. The advisory does not state a CVSS score, workarounds, or detection guidance. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from go.dev/issue/82345 ScoreNo CVSS score published. AffectsGo standard libraryGoGo standard library crypto/x509GoGo crypto/x509
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||