PatchTheCVECVE-2026-111943: On most platforms, Go uses the given system root certificates
CVE-2026-111943 is a high-severity flaw (CVSS n/a) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
Why this priority
- Covered by 5 security sources
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | n/a (High) |
| EPSS exploit chance | 0.1% (top 97%) |
| CISA exploited list | No |
| Published | 2026-10-21 |
| Last modified | 2026-10-22 |
Last updated 2026-10-22 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Official advisories
- Go Vulnerability Database commits: data/reports: add GO-2026-6809 2026-10-21
- Rust Blog: Announcing rustup 1.29.2 2026-10-20
- Docker Engine Releases: v29.9.2 2026-10-20
- RustSec Advisory Database commits: add rustls-webpki advisories related to CVE-2026-111943 2026-10-20
Research and news
- Qualys Blog: How to Identify Compromised eMudhra Certificates With Qualys (CVE-2026-111943 and CVE-2026-111944) 2026-10-24
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-111943?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-111943 being exploited?
CVE-2026-111943 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-111943 affect?
CVE-2026-111943 affects affected software. Severity is high (CVSS n/a). On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denyl
How urgent is CVE-2026-111943?
Priority 4/100. Covered by 5 security sources