RUSTSEC-2026-0381Published
Distrust compromised intermediate certificates in crypto/x509
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111943 · Microsoft / collected KEV context
cve-program · CVE-2026-111943
- https://go.dev/cl/851047
- https://go.dev/issue/82345
- https://groups.google.com/g/golang-announce/c/66pojueaQek
- https://pkg.go.dev/vuln/GO-2026-6809
euvd · EUVD-2026-106926
- https://go.dev/cl/851047
- https://go.dev/issue/82345
- https://groups.google.com/g/golang-announce/c/66pojueaQek
- https://pkg.go.dev/vuln/GO-2026-6809
nvd · CVE-2026-111943
- https://go.dev/cl/851047
- https://go.dev/issue/82345
- https://groups.google.com/g/golang-announce/c/66pojueaQek
- https://pkg.go.dev/vuln/GO-2026-6809
- http://www.openwall.com/lists/oss-security/2026/10/20/29
osv · GO-2026-6809
- https://go.dev/cl/851047
- https://go.dev/issue/82345
- https://groups.google.com/g/golang-announce/c/66pojueaQek
osv · RUSTSEC-2026-0381
- https://crates.io/crates/webpki-roots
- https://rustsec.org/advisories/RUSTSEC-2026-0381.html
- https://github.com/rustls/webpki-roots/pull/133
- https://emudhra.we-have-a-problem.com/
- https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
osv · RUSTSEC-2026-0382
- https://crates.io/crates/rustls-webpki
- https://rustsec.org/advisories/RUSTSEC-2026-0382.html
- https://github.com/rustls/webpki/pull/546
- https://emudhra.we-have-a-problem.com/
- https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
osv · RUSTSEC-2026-0383
Related operational evidence
Explicit CVE identifiers- On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denyl… · Advisory content revised · 7 Nov 2026
- On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denyl… · Advisory content revised · 5 Nov 2026
- On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denyl… · Advisory content revised · 3 Nov 2026
- On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denyl… · Advisory content revised · 1 Nov 2026
- On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denyl… · Advisory content revised · 31 Oct 2026
- On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denyl… · Advisory content revised · 30 Oct 2026
- Distrust compromised intermediate certificates in crypto/x509 · Advisory content revised · 29 Oct 2026
- Bundled root certificates allow trust in distrusted emSign intermediates · Advisory content revised · 29 Oct 2026
- Certificate verification may accept distrusted intermediates · Advisory content revised · 29 Oct 2026
- Bundled root certificates allow trust in distrusted emSign intermediates · Advisory content revised · 29 Oct 2026