CVE-2026-111943

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.27.3 Go versions prior to 1.26.10

Description Eight intermediate CA certificates from eMudhra (emSign) were found to have flawed key generation, allowing the private keys to be recovered. This issue could allow an attacker to create fraudulent certificates that are accepted by clients that do not check revocation lists or have outdated trust stores. To mitigate this, a denylist was added to the crypto/x509 package to return an error when the Verify() function is called with any of these untrustworthy intermediate certificates. Approximately 30,000 certificates are estimated to be affected and require migration.

Recommendations Upgrade to Go version 1.27.3 or 1.26.10 and rebuild applications. As a temporary mitigation, restrict the use of the Verify() function in crypto/x509 when processing certificates from the emSign ECC Root CA - G3 chain.