Bug 2556068 (CVE-2026-111943) - CVE-2026-111943 crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates
Summary: CVE-2026-111943 crypto/x509: golang: crypto/x509: Man-in-the-middle attacks v...
Keywords:
Status: NEW
Alias: CVE-2026-111943
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2556081 2558900 2558901
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-20 09:43 UTC by OSIDB Bzimport
Modified: 2026-10-23 19:06 UTC (History)
82 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:86093 0 None None None 2026-10-20 20:27:12 UTC
Red Hat Product Errata RHSA-2026:86196 0 None None None 2026-10-20 22:53:50 UTC
Red Hat Product Errata RHSA-2026:86203 0 None None None 2026-10-20 21:57:53 UTC
Red Hat Product Errata RHSA-2026:86972 0 None None None 2026-10-21 13:21:52 UTC
Red Hat Product Errata RHSA-2026:86973 0 None None None 2026-10-21 13:12:57 UTC
Red Hat Product Errata RHSA-2026:87040 0 None None None 2026-10-21 14:28:41 UTC
Red Hat Product Errata RHSA-2026:87041 0 None None None 2026-10-21 14:32:57 UTC
Red Hat Product Errata RHSA-2026:87042 0 None None None 2026-10-21 14:37:06 UTC
Red Hat Product Errata RHSA-2026:87043 0 None None None 2026-10-21 14:44:09 UTC
Red Hat Product Errata RHSA-2026:87245 0 None None None 2026-10-21 19:34:48 UTC
Red Hat Product Errata RHSA-2026:87246 0 None None None 2026-10-21 18:34:18 UTC
Red Hat Product Errata RHSA-2026:87732 0 None None None 2026-10-22 06:23:07 UTC
Red Hat Product Errata RHSA-2026:87911 0 None None None 2026-10-22 07:08:21 UTC
Red Hat Product Errata RHSA-2026:88188 0 None None None 2026-10-22 11:42:46 UTC
Red Hat Product Errata RHSA-2026:88189 0 None None None 2026-10-22 11:59:57 UTC
Red Hat Product Errata RHSA-2026:88262 0 None None None 2026-10-22 14:55:06 UTC
Red Hat Product Errata RHSA-2026:88280 0 None None None 2026-10-22 15:06:44 UTC
Red Hat Product Errata RHSA-2026:88316 0 None None None 2026-10-22 15:40:39 UTC
Red Hat Product Errata RHSA-2026:88317 0 None None None 2026-10-22 15:33:29 UTC
Red Hat Product Errata RHSA-2026:88332 0 None None None 2026-10-22 16:26:58 UTC
Red Hat Product Errata RHSA-2026:88336 0 None None None 2026-10-22 17:02:04 UTC
Red Hat Product Errata RHSA-2026:88339 0 None None None 2026-10-22 16:36:23 UTC
Red Hat Product Errata RHSA-2026:88340 0 None None None 2026-10-22 17:13:49 UTC
Red Hat Product Errata RHSA-2026:88354 0 None None None 2026-10-22 17:40:05 UTC
Red Hat Product Errata RHSA-2026:88394 0 None None None 2026-10-22 18:38:25 UTC
Red Hat Product Errata RHSA-2026:88395 0 None None None 2026-10-22 18:42:23 UTC
Red Hat Product Errata RHSA-2026:88396 0 None None None 2026-10-22 18:44:31 UTC
Red Hat Product Errata RHSA-2026:88397 0 None None None 2026-10-22 18:39:51 UTC

Description OSIDB Bzimport 2026-10-20 09:43:11 UTC 
Go releases 1.27.3 and 1.26.10 address the following issue:

https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU

crypto/x509: mitigation for security concerns with a specific Certificate Authority

We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.

Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.

We highly recommend immediately upgrading to this release.

This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.
Comment 2 Jon Orris 2026-10-20 20:27:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:86093 https://access.redhat.com/errata/RHSA-2026:86093
Comment 3 Jon Orris 2026-10-20 21:57:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:86203 https://access.redhat.com/errata/RHSA-2026:86203
Comment 4 Jon Orris 2026-10-20 22:53:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:86196 https://access.redhat.com/errata/RHSA-2026:86196
Comment 5 Jon Orris 2026-10-21 13:12:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:86973 https://access.redhat.com/errata/RHSA-2026:86973
Comment 6 Jon Orris 2026-10-21 13:21:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:86972 https://access.redhat.com/errata/RHSA-2026:86972
Comment 7 Jon Orris 2026-10-21 14:28:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:87040 https://access.redhat.com/errata/RHSA-2026:87040
Comment 8 Jon Orris 2026-10-21 14:32:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:87041 https://access.redhat.com/errata/RHSA-2026:87041
Comment 9 Jon Orris 2026-10-21 14:37:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:87042 https://access.redhat.com/errata/RHSA-2026:87042
Comment 10 Jon Orris 2026-10-21 14:44:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:87043 https://access.redhat.com/errata/RHSA-2026:87043
Comment 11 Jon Orris 2026-10-21 18:34:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:87246 https://access.redhat.com/errata/RHSA-2026:87246
Comment 12 Jon Orris 2026-10-21 19:34:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:87245 https://access.redhat.com/errata/RHSA-2026:87245
Comment 14 Jon Orris 2026-10-22 06:23:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:87732 https://access.redhat.com/errata/RHSA-2026:87732
Comment 15 Jon Orris 2026-10-22 07:08:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:87911 https://access.redhat.com/errata/RHSA-2026:87911
Comment 17 Jon Orris 2026-10-22 11:42:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:88188 https://access.redhat.com/errata/RHSA-2026:88188
Comment 18 Jon Orris 2026-10-22 11:59:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:88189 https://access.redhat.com/errata/RHSA-2026:88189
Comment 19 Jon Orris 2026-10-22 14:55:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:88262 https://access.redhat.com/errata/RHSA-2026:88262
Comment 20 Jon Orris 2026-10-22 15:06:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:88280 https://access.redhat.com/errata/RHSA-2026:88280
Comment 21 Jon Orris 2026-10-22 15:33:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:88317 https://access.redhat.com/errata/RHSA-2026:88317
Comment 22 Jon Orris 2026-10-22 15:40:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:88316 https://access.redhat.com/errata/RHSA-2026:88316
Comment 23 Jon Orris 2026-10-22 16:26:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:88332 https://access.redhat.com/errata/RHSA-2026:88332
Comment 24 Jon Orris 2026-10-22 16:36:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:88339 https://access.redhat.com/errata/RHSA-2026:88339
Comment 25 Jon Orris 2026-10-22 17:01:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:88336 https://access.redhat.com/errata/RHSA-2026:88336
Comment 26 Jon Orris 2026-10-22 17:13:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:88340 https://access.redhat.com/errata/RHSA-2026:88340
Comment 27 Jon Orris 2026-10-22 17:40:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:88354 https://access.redhat.com/errata/RHSA-2026:88354
Comment 28 Jon Orris 2026-10-22 18:38:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:88394 https://access.redhat.com/errata/RHSA-2026:88394
Comment 29 Jon Orris 2026-10-22 18:39:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:88397 https://access.redhat.com/errata/RHSA-2026:88397
Comment 30 Jon Orris 2026-10-22 18:42:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:88395 https://access.redhat.com/errata/RHSA-2026:88395
Comment 31 Jon Orris 2026-10-22 18:44:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:88396 https://access.redhat.com/errata/RHSA-2026:88396
Note You need to log in before you can comment on or make changes to this bug.