🔒Go1.28 Blocks Trust in Vulnerable Certificates
Go1.28 blocks trust in a set of insecure certificates
TL;DR
Go1.28 blocks trust in a small set of intermediate certificates, mitigating a security risk. This update affects Go applications and systems using Go's crypto/x509 package. The fix was released in Go1.28 and backported to 1.26 and 1.27.
Go1.28 blocks trust in a small set of intermediate certificates, addressing a critical security issue. This update affects Go applications and systems using Go's crypto/x509 package, ensuring enhanced security for certificate validation. The fix was released in Go1.28 and backported to 1.26 and 1.27, mitigating the risk of compromised certificates. The issue was labeled as a security and release-blocker, emphasizing its urgency.
Key Points
Go1.28 blocks trust in a small set of intermediate certificates, addressing CVE-2026-111943.
The fix was released in Go1.28 and backported to 1.26 and 1.27.
The issue was tracked as #82345 and labeled as Security and release-blocker.
The update was added to the Go1.28 milestone and closed on October 20, 2026.
The patch was submitted to master and mentioned in https://go.dev/cl/851165.
Why It Matters
If you're using Go's crypto/x509 package, this update blocks trust in a small set of insecure intermediate certificates, enhancing security. The fix is critical for Go applications and systems handling certificate validation. The update was backported to Go1.26 and 1.27, ensuring broader protection.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.