Vulnerability · Published Oct 21, 2026 · Assigned by Go

CVE-2026-111943Distrust compromised intermediate certificates in crypto/x509

Medium 6.8

In plain English

A medium-severity security flaw in crypto/x509 from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.4%top 66.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+4047+545787c4ALSA-2026:89760
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+4023+db236c53ALSA-2026:89760
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+3901+4b80ecd7ALSA-2026:89760
AlmaLinux:10buildah2:1.43.1-7.el10_2ALSA-2026:88262
AlmaLinux:8buildah2:1.33.15-2.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:9buildah2:1.43.4-2.el9_8ALSA-2026:90424
AlmaLinux:10buildah-tests2:1.43.1-7.el10_2ALSA-2026:88262
AlmaLinux:8buildah-tests2:1.33.15-2.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:9buildah-tests2:1.43.4-2.el9_8ALSA-2026:90424
AlmaLinux:8cockpit-podman84.1-1.module_el8.10.0+4102+6c76e544ALSA-2026:89760
AlmaLinux:8conmon3:2.1.10-2.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:8container-selinux2:2.229.0-3.module_el8.10.0+4213+0493256bALSA-2026:89760
AlmaLinux:8containernetworking-plugins1:1.4.0-11.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:8containers-common2:1-82.module_el8.10.0+4016+efd18bf8ALSA-2026:89760
AlmaLinux:8containers-common2:1-82.module_el8.10.0+3876+e55593a8ALSA-2026:89760
AlmaLinux:8containers-common2:1-82.module_el8.10.0+4120+03ad4b47ALSA-2026:89760
AlmaLinux:8containers-common2:1-82.module_el8.10.0+4089+ce72bbbeALSA-2026:89760
AlmaLinux:8crit3.18-5.module_el8.10.0+3845+87b84552ALSA-2026:89760
AlmaLinux:8crit3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:89760
AlmaLinux:8crit3.18-5.module_el8.10.0+4047+545787c4ALSA-2026:89760
AlmaLinux:8criu3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:89760
AlmaLinux:8criu3.18-5.module_el8.10.0+3876+e55593a8ALSA-2026:89760
AlmaLinux:8criu3.18-5.module_el8.10.0+3845+87b84552ALSA-2026:89760
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4016+efd18bf8ALSA-2026:89760
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+3845+87b84552ALSA-2026:89760
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4089+ce72bbbeALSA-2026:89760
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4068+0e21408fALSA-2026:89760
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3845+87b84552ALSA-2026:89760
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3970+8445edf6ALSA-2026:89760
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3909+6e1c1eb7ALSA-2026:89760
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+4082+f7f0c95eALSA-2026:89760
AlmaLinux:8crun1.14.3-4.module_el8.10.0+4269+94686149ALSA-2026:89760
AlmaLinux:10delve1.26.1-3.el10_2ALSA-2026:95519
AlmaLinux:8delve1.26.1-2.module_el8.10.0+4353+8cb525ccALSA-2026:95638
AlmaLinux:8delve1.26.1-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:9delve1.26.1-2.el9_8ALSA-2026:95518
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+3792+03eaed9cALSA-2026:89760
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+4068+0e21408fALSA-2026:89760
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+4082+f7f0c95eALSA-2026:89760
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+3909+6e1c1eb7ALSA-2026:89760
AlmaLinux:10go-toolset1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8go-toolset1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:8go-toolset1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:95638
AlmaLinux:9go-toolset1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:95638
AlmaLinux:8golang1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:9golang1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang-bin1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang-bin1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:95638
AlmaLinux:8golang-bin1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:9golang-bin1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang-docs1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang-docs1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:8golang-docs1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:95638
AlmaLinux:9golang-docs1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang-misc1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang-misc1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:8golang-misc1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:95638
AlmaLinux:9golang-misc1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang-race1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang-race1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:95638
AlmaLinux:8golang-race1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:9golang-race1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang-src1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang-src1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:8golang-src1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:95638
AlmaLinux:9golang-src1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:10golang-tests1.26.10-1.el10_2.alma.1ALSA-2026:86093
AlmaLinux:8golang-tests1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:95638
AlmaLinux:8golang-tests1.26.10-1.module_el8.10.0+4307+6e4cbc60ALSA-2026:86203
AlmaLinux:9golang-tests1.26.10-1.el9_8ALSA-2026:86196
AlmaLinux:8grafana9.2.10-36.el8_10ALSA-2026:88188
AlmaLinux:9grafana10.2.6-23.el9_8.7ALSA-2026:89744
AlmaLinux:10grafana-pcp5.3.0-8.el10_2.2ALSA-2026:88316
AlmaLinux:8grafana-pcp5.1.1-19.el8_10ALSA-2026:88189
AlmaLinux:9grafana-pcp5.1.1-17.el9_8.2ALSA-2026:88354
AlmaLinux:8grafana-selinux9.2.10-36.el8_10ALSA-2026:88188
AlmaLinux:9grafana-selinux10.2.6-23.el9_8.7ALSA-2026:89744
AlmaLinux:10ignition2.26.0-3.el10_2.4ALSA-2026:91720
AlmaLinux:9ignition2.26.0-1.el9_8.2ALSA-2026:91719
AlmaLinux:10ignition-edge2.26.0-3.el10_2.4ALSA-2026:91720
AlmaLinux:9ignition-edge2.26.0-1.el9_8.2ALSA-2026:91719
AlmaLinux:10ignition-grub2.26.0-3.el10_2.4ALSA-2026:91720
AlmaLinux:9ignition-grub2.26.0-1.el9_8.2ALSA-2026:91719
AlmaLinux:10ignition-validate2.26.0-3.el10_2.4ALSA-2026:91720
AlmaLinux:9ignition-validate2.26.0-1.el9_8.2ALSA-2026:91719
AlmaLinux:10ipp-usb0.9.27-7.el10_2.4ALSA-2026:88280
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4016+efd18bf8ALSA-2026:89760
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4120+03ad4b47ALSA-2026:89760
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4090+91932338ALSA-2026:89760
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+3845+87b84552ALSA-2026:89760
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4082+f7f0c95eALSA-2026:89760
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4102+6c76e544ALSA-2026:89760
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+3845+87b84552ALSA-2026:89760
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4068+0e21408fALSA-2026:89760
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4047+545787c4ALSA-2026:89760
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4082+f7f0c95eALSA-2026:89760
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+3845+87b84552ALSA-2026:89760
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+3926+f12484f5ALSA-2026:89760
AlmaLinux:10oci-seccomp-bpf-hook1.2.11-3.el10_2ALSA-2026:89752
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-4.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:10opentelemetry-collector0.158.0-2.el10_2ALSA-2026:93596
AlmaLinux:9opentelemetry-collector0.158.0-2.el9_8ALSA-2026:93617
AlmaLinux:10podman7:5.8.2-11.el10_2.alma.1ALSA-2026:88336
AlmaLinux:8podman4:4.9.4-38.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:9podman6:5.8.2-8.el9_8ALSA-2026:90362
AlmaLinux:8podman-catatonit4:4.9.4-38.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:10podman-docker7:5.8.2-11.el10_2.alma.1ALSA-2026:88336
AlmaLinux:8podman-docker4:4.9.4-38.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:9podman-docker6:5.8.2-8.el9_8ALSA-2026:90362
AlmaLinux:8podman-gvproxy4:4.9.4-38.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:8podman-plugins4:4.9.4-38.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:9podman-plugins6:5.8.2-8.el9_8ALSA-2026:90362
AlmaLinux:10podman-remote7:5.8.2-11.el10_2.alma.1ALSA-2026:88336
AlmaLinux:8podman-remote4:4.9.4-38.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:9podman-remote6:5.8.2-8.el9_8ALSA-2026:90362
AlmaLinux:10podman-tests7:5.8.2-11.el10_2.alma.1ALSA-2026:88336
AlmaLinux:8podman-tests4:4.9.4-38.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:9podman-tests6:5.8.2-8.el9_8ALSA-2026:90362
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3845+87b84552ALSA-2026:89760
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3901+4b80ecd7ALSA-2026:89760
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+4047+545787c4ALSA-2026:89760
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:89760
AlmaLinux:8python3-podman4.9.0-3.module_el8.10.0+4016+efd18bf8ALSA-2026:89760
AlmaLinux:8runc4:1.2.9-9.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:10skopeo2:1.22.2-6.el10_2ALSA-2026:89761
AlmaLinux:8skopeo2:1.14.6-5.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:9skopeo2:1.22.2-9.el9_8ALSA-2026:90462
AlmaLinux:10skopeo-tests2:1.22.2-6.el10_2ALSA-2026:89761
AlmaLinux:8skopeo-tests2:1.14.6-5.module_el8.10.0+4327+ab8e4068ALSA-2026:89760
AlmaLinux:9skopeo-tests2:1.22.2-9.el9_8ALSA-2026:90462
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4082+f7f0c95eALSA-2026:89760
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+3845+87b84552ALSA-2026:89760
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4023+db236c53ALSA-2026:89760
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+3901+4b80ecd7ALSA-2026:89760
AlmaLinux:8toolbox0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47ALSA-2026:89760
AlmaLinux:8toolbox-tests0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47ALSA-2026:89760
AlmaLinux:8udica0.2.6-21.module_el8.10.0+4068+0e21408fALSA-2026:89760
AlmaLinux:10yggdrasil0.4.9.2-1.el10_2.4ALSA-2026:91138
AlmaLinux:10yggdrasil-devel0.4.9.2-1.el10_2.4ALSA-2026:91138
Alpine:v3.24docker29.9.2-r0ALPINE-CVE-2026-111943
Alpine:v3.24docker-cli-buildx0.38.1-r0ALPINE-CVE-2026-111943
Alpine:v3.24docker-cli-compose5.6.1-r0ALPINE-CVE-2026-111943
Alpine:v3.24go1.26.10-r0ALPINE-CVE-2026-111943
Debian:12golang-1.19no fix listedDEBIAN-CVE-2026-111943
Debian:13golang-1.24no fix listedDEBIAN-CVE-2026-111943
Debian:14golang-1.261.26.10-1DEBIAN-CVE-2026-111943
Debian:14golang-1.271.27.3-1DEBIAN-CVE-2026-111943
Gostdlib1.26.10, 1.27.3GO-2026-6809
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1896+b18fa106RLSA-2026:89760
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+2001+6a33db9fRLSA-2026:89760
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9RLSA-2026:89760
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+40133+32c21f88RLSA-2026:89760
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1874+ce489889RLSA-2026:89760
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1880+8e896d1bRLSA-2026:89760
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+40047+0c0a73f4RLSA-2026:89760
Rocky Linux:10buildah2:1.43.1-7.el10_2RLSA-2026:88262
Rocky Linux:9buildah2:1.43.4-2.el9_8RLSA-2026:90424
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1896+b18fa106RLSA-2026:89760
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1948+4b5cd4a9RLSA-2026:89760
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+2001+6a33db9fRLSA-2026:89760
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+40047+0c0a73f4RLSA-2026:89760
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+40133+32c21f88RLSA-2026:89760
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1815+5fe7415eRLSA-2026:89760
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1825+623b0c20RLSA-2026:89760
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1843+6892ab28RLSA-2026:89760
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1872+2e18eb19RLSA-2026:89760
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1874+ce489889RLSA-2026:89760
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1880+8e896d1bRLSA-2026:89760
Rocky Linux:8container-selinux2:2.229.0-3.module+el8.10.0+40223+e940a224RLSA-2026:89760
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1948+4b5cd4a9RLSA-2026:89760
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1896+b18fa106RLSA-2026:89760
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1872+2e18eb19RLSA-2026:89760
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1880+8e896d1bRLSA-2026:89760
Rocky Linux:8containers-common2:1-82.module+el8.10.0+2001+6a33db9fRLSA-2026:89760
Rocky Linux:8containers-common2:1-82.module+el8.10.0+40047+0c0a73f4RLSA-2026:89760
Rocky Linux:8containers-common2:1-82.module+el8.10.0+40133+32c21f88RLSA-2026:89760
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1843+6892ab28RLSA-2026:89760
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1874+ce489889RLSA-2026:89760
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1896+b18fa106RLSA-2026:89760
Rocky Linux:8criu0:3.18-5.module+el8.10.0+40047+0c0a73f4RLSA-2026:89760
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1872+2e18eb19RLSA-2026:89760
Rocky Linux:8criu0:3.18-5.module+el8.10.0+40133+32c21f88RLSA-2026:89760
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1874+ce489889RLSA-2026:89760
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1880+8e896d1bRLSA-2026:89760
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1815+5fe7415eRLSA-2026:89760
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1825+623b0c20RLSA-2026:89760
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1948+4b5cd4a9RLSA-2026:89760
Rocky Linux:8criu0:3.18-5.module+el8.10.0+2001+6a33db9fRLSA-2026:89760
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1843+6892ab28RLSA-2026:89760
Rocky Linux:8crun0:1.14.3-4.module+el8.10.0+40310+c25440c1RLSA-2026:89760
Rocky Linux:10delve0:1.26.1-3.el10_2RLSA-2026:95519
Rocky Linux:8delve0:1.26.1-2.module+el8.10.0+40408+b9bc4117RLSA-2026:95638
Rocky Linux:8delve0:1.26.1-1.module+el8.10.0+40244+e7cb3ff8RLSA-2026:86203
Rocky Linux:9delve0:1.26.1-2.el9_8RLSA-2026:95518
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1815+5fe7415eRLSA-2026:89760
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1874+ce489889RLSA-2026:89760
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1880+8e896d1bRLSA-2026:89760
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1896+b18fa106RLSA-2026:89760

Affected products (as reported)

VendorProductVersions
Go standard library crypto/x509 0 – before 1.26.101.27.0-0 – before 1.27.3

Weakness: CWE-299 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References