{"id":"GO-2026-6809","aliases":["RUSTSEC-2026-0381","BIT-golang-2026-111943","CVE-2026-111943","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"title":"Bundled root certificates allow trust in distrusted emSign intermediates","titleSource":"OSV","descriptionSource":"OSV","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.\n\nTo defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.","severity":"medium","score":6.8,"published":"2026-10-19T12:00:00.000Z","modified":"2026-11-14T13:12:13.569Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"crates.io","name":"webpki-roots","sources":[{"name":"OSV · RUSTSEC-2026-0381","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0381"}],"ranges":[{"events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.11"},{"introduced":"0.26.12-0"},{"fixed":"1.0.10"}],"type":"SEMVER"}],"versions":[],"fixed":["0.26.11","1.0.10"]},{"ecosystem":"crates.io","name":"rustls-webpki","sources":[{"name":"OSV · RUSTSEC-2026-0382","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0382"}],"ranges":[{"events":[{"introduced":"0.0.0-0"},{"fixed":"0.103.16"},{"introduced":"0.104.0-alpha.1"},{"fixed":"0.104.0-alpha.8"}],"type":"SEMVER"}],"versions":[],"fixed":["0.103.16","0.104.0-alpha.8"]},{"ecosystem":"crates.io","name":"webpki-root-certs","sources":[{"name":"OSV · RUSTSEC-2026-0383","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0383"}],"ranges":[{"events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.11"},{"introduced":"0.26.12-0"},{"fixed":"1.0.10"}],"type":"SEMVER"}],"versions":[],"fixed":["0.26.11","1.0.10"]},{"ecosystem":"Go","name":"stdlib","sources":[{"name":"OSV · GO-2026-6809","url":"https://osv.dev/vulnerability/GO-2026-6809"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.26.10"},{"introduced":"1.27.0-0"},{"fixed":"1.27.3"}],"type":"SEMVER"}],"versions":[],"fixed":["1.26.10","1.27.3"]}],"sourceAffected":[],"references":["https://crates.io/crates/webpki-roots","https://rustsec.org/advisories/RUSTSEC-2026-0381.html","https://github.com/rustls/webpki-roots/pull/133","https://emudhra.we-have-a-problem.com/","https://bugzilla.mozilla.org/show_bug.cgi?id=2083449","https://crates.io/crates/rustls-webpki","https://rustsec.org/advisories/RUSTSEC-2026-0382.html","https://github.com/rustls/webpki/pull/546","https://crates.io/crates/webpki-root-certs","https://rustsec.org/advisories/RUSTSEC-2026-0383.html","https://go.dev/cl/851047","https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek","https://pkg.go.dev/vuln/GO-2026-6809","http://www.openwall.com/lists/oss-security/2026/10/20/29"],"sources":[{"name":"OSV","id":"RUSTSEC-2026-0381","modified":"2026-10-29T10:55:54.096394276Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0381"},{"name":"OSV","id":"RUSTSEC-2026-0382","modified":"2026-10-29T10:55:54.096394276Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0382"},{"name":"OSV","id":"RUSTSEC-2026-0383","modified":"2026-10-29T10:55:54.096394276Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0383"},{"name":"CVE","id":"CVE-2026-111943","modified":"2026-10-30T13:08:13.559Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111943"},{"name":"OSV","id":"GO-2026-6809","modified":"2026-11-14T13:12:13.569550999Z","url":"https://osv.dev/vulnerability/GO-2026-6809"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":6.8}],"cve":{"records":[{"id":"CVE-2026-111943","source":"Go","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-17T13:43:28.599Z","published":"2026-10-21T00:52:18.359Z","modified":"2026-10-30T13:08:13.559Z"}],"publishers":[{"name":"Go","role":"CNA","organizationId":"1bb62c36-49e3-4200-9d77-64a1400537cc","modified":"2026-10-21T00:52:18.359Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-10-21T01:24:20.498Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T13:08:13.559Z"}],"references":[{"url":"https://go.dev/cl/851047","tags":[],"source":"Go"},{"url":"https://go.dev/issue/82345","tags":[],"source":"Go"},{"url":"https://groups.google.com/g/golang-announce/c/66pojueaQek","tags":[],"source":"Go"},{"url":"https://pkg.go.dev/vuln/GO-2026-6809","tags":[],"source":"Go"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/29","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-299","description":"CWE-299 Improper Check for Certificate Revocation","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T13:08:09.750640Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"products":[{"vendor":"Go standard library","name":"crypto/x509","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.26.10","versionType":"semver"},{"version":"1.27.0-0","status":"affected","lessThan":"1.27.3","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Go","url":"https://www.cve.org/CVERecord?id=CVE-2026-111943"}],"remediation":[],"observedAt":"2026-11-14T15:05:21.527Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:15:34.962Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T16:05:47.660Z","attemptedAt":"2026-10-30T16:05:47.660Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T16:05:35.091Z","attemptedAt":"2026-10-30T16:05:35.091Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T16:05:36.707Z","attemptedAt":"2026-10-30T16:05:36.707Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T16:05:34.263Z","attemptedAt":"2026-10-30T16:05:34.263Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-111943","url":"https://www.first.org/epss/","probability":0.00299,"percentile":0.22602,"date":"2026-10-30","checkedAt":"2026-10-30T16:05:34.263Z"},{"source":"ENISA EUVD","id":"EUVD-2026-106926","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-106926","modified":"Oct 30, 2026, 1:08:13 PM","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","checkedAt":"2026-10-30T16:05:36.707Z"},{"source":"NVD","id":"CVE-2026-111943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111943","modified":"2026-10-30T13:18:28.740","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","checkedAt":"2026-10-30T16:05:47.660Z"}],"aiSummary":null}