ZDF
Sign inSign up

Vulnerabilities

Security incident · CVE-2026-111943

Distrust compromised intermediate certificates in crypto/x509

Published Oct 19, 2026 · catalog updated Oct 21, 2026 · Distrust compromised intermediate certificates

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-111943. A missing EPSS score is not a low risk. Compare Distrust compromised intermediate certificates with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Distrust compromised intermediate certificates).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Unknown—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Awaiting synchronization with FIRST
Remediation
Fix linked
Affected products
Go stdlib · crates.io rustls-webpki · crates.io webpki-root-certs · crates.io webpki-roots

Affected versions include , which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well known. Version 1.0.10+ removes this root. The 0.26.11 compatibility package contains no independent trust store and re-exports the roots from its separately resolved 1.x dependency. That parent dependency must resolve to 1.0.10 or newer; an older parent remains affected by this advisory.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go stdlib0 → 1.26.10
  • crates.io rustls-webpki0.0.0-0 → 0.103.16
  • crates.io webpki-root-certs0.0.0-0 → 0.26.11
  • crates.io webpki-roots0.0.0-0 → 0.26.11

How to fix CVE-2026-111943

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for CVE-2026-111943. A missing EPSS score is not a low risk. Compare Distrust compromised intermediate certificates with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with 0 → 1.26.10, 0.0.0-0 → 0.103.16, 0.0.0-0 → 0.26.11. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Related Odoo Git fixes

Quoted Community commit messages that cite this CVE. Presence of a commit is not proof that every edition or backport includes the fix. Enterprise proprietary diffs are never shown here. Timeline

  • Oct 20, 2026 · referenced

    Update to go1.26.10

    Update to go1.26.10 These releases include 1 security fix following the security policy: - crypto/x509: mitigation for security concerns with a specific Certificate Authority We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation. Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller. We highly recommend immediately upgrading to this release. This is CVE-2026-111943 and Go issue https://go.dev/issue/82345. release notes: https://go.dev/doc/devel/release#go1.26.10
    https://github.com/moby/moby/commit/0b084f4c2dc1d5d8b605b5c58783bf5009d3b7e9

Timeline

Detection, updates, and resolution for this record.

  1. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Detected

    On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustwor

  2. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    stdlib fixed in 1.26.10

  3. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    stdlib fixed in 1.26.10

  4. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    rustls-webpki fixed in 0.103.16

  5. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    rustls-webpki fixed in 0.103.16

  6. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustwor

  7. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    webpki-root-certs fixed in 0.26.11

  8. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    webpki-roots fixed in 0.26.11

  9. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    webpki-roots fixed in 0.26.11

  10. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    webpki-root-certs fixed in 0.26.11

  11. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    Affected versions include , which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well known. Version 1.0.10+ removes this root. The 0.26.11 compatibility package contains no independent trust store and re-exports t

Sources

References

Freshness

Last verified in this catalog Oct 21, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.