On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
Fix
Public exploits 5
- BlackthornYugen/tiny-key-s-server PoC on GitHub
- Xowap/i-can-count-to-four PoC on GitHub
- andersundsehr/ca-trust-audit PoC on GitHub
- majiayu000/trustsweep PoC on GitHub
- phpc0de/CVE-2026-111943-Remediator PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Vendor advisories in the News 1
- CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles AWS Security Bulletins · 2026-10-25
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 6
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-22 16:18
- StatusReceived → PublishedNVD modified 2026-10-21 01:24
- References+1 references (now 5)NVD modified 2026-10-21 02:17
- StatusPublished → ReceivedNVD modified 2026-10-21 02:17
- StatusReceived → PublishedNVD modified 2026-10-21 00:52
- First seenunscoredNVD modified 2026-10-21 01:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.