ZDF
Sign inSign up

Vulnerabilities

Security incident · CVE-2026-111943

Distrust compromised intermediate certificates in crypto/x509

Published Oct 19, 2026 · catalog updated Oct 21, 2026 · RustSec Rust

Check if you run it

No confirmed exploitation is on record for CVE-2026-111943. EPSS is 0.14%. Act only if a listed version of RustSec Rust is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Unknown—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.14%
Remediation
Fix linked
Affected products
Go stdlib · crates.io rustls-webpki · crates.io webpki-root-certs · crates.io webpki-roots

Affected versions include , which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well known. Version 1.0.10+ removes this root. The 0.26.11 compatibility package contains no independent trust store and re-exports the roots from its separately resolved 1.x dependency. That parent dependency must resolve to 1.0.10 or newer; an older parent remains affected by this advisory.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go stdlib0 → 1.26.10
  • crates.io rustls-webpki0.0.0-0 → 0.103.16
  • crates.io webpki-root-certs0.0.0-0 → 0.26.11
  • crates.io webpki-roots0.0.0-0 → 0.26.11

How to fix CVE-2026-111943

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-111943. EPSS is 0.14%. Act only if a listed version of RustSec Rust is installed.

Which versions are affected?

Compare what you have installed with 0 → 1.26.10, 0.0.0-0 → 0.103.16, 0.0.0-0 → 0.26.11. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.14%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Cisco security

Code

The project this record applies to. Exploit listings stay in References.

Related Odoo Git fixes

Quoted Community commit messages that cite this CVE. Presence of a commit is not proof that every edition or backport includes the fix. Enterprise proprietary diffs are never shown here. Timeline

  • Oct 20, 2026 · referenced

    Update to go1.26.10

    Update to go1.26.10 These releases include 1 security fix following the security policy: - crypto/x509: mitigation for security concerns with a specific Certificate Authority We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation. Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller. We highly recommend immediately upgrading to this release. This is CVE-2026-111943 and Go issue https://go.dev/issue/82345. release notes: https://go.dev/doc/devel/release#go1.26.10
    https://github.com/moby/moby/commit/0b084f4c2dc1d5d8b605b5c58783bf5009d3b7e9

Timeline

Detection, updates, and resolution for this record.

  1. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Detected

    On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustwor

  2. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    stdlib fixed in 1.26.10

  3. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    stdlib fixed in 1.26.10

  4. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    rustls-webpki fixed in 0.103.16

  5. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    rustls-webpki fixed in 0.103.16

  6. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustwor

  7. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    webpki-root-certs fixed in 0.26.11

  8. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    webpki-roots fixed in 0.26.11

  9. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    webpki-roots fixed in 0.26.11

  10. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    webpki-root-certs fixed in 0.26.11

  11. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    Affected versions include , which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well known. Version 1.0.10+ removes this root. The 0.26.11 compatibility package contains no independent trust store and re-exports t

Sources

  • BSI CERT-BundGovernment advisoryCVE-2026-111943

    Golang Go: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

    wid.cert-bund.de
  • CVE.orgVulnerability recordCVE-2026-111943

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-111943

    30-day exploitation probability 0.14%

    first.org
  • Gentoo GLSAVendor advisoryCVE-2026-111943

    ca-certificates: Compromised Intermediate Certificate Authority (GLSA 202610-01) — Gentoo security

    security.gentoo.org
  • Go Vulnerability DatabasePackage advisoryGO-2026-6809

    Distrust compromised intermediate certificates in crypto/x509

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryGO-2026-6809

    Distrust compromised intermediate certificates in crypto/x509

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryRUSTSEC-2026-0381

    Bundled root certificates allow trust in distrusted emSign intermediates

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryRUSTSEC-2026-0382

    Certificate verification may accept distrusted intermediates

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryRUSTSEC-2026-0383

    Bundled root certificates allow trust in distrusted emSign intermediates

    osv.dev
  • RustSec Advisory DBVendor advisoryCVE-2026-111943

    Affected versions include , which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well known. V

    crates.io
  • Cisco TalosVendor advisoryCVE-2026-111943

    Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.

    blog.talosintelligence.com

References

Freshness

Last verified in this catalog Oct 23, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.