Vulnpedia
← Search CVEs

CVE-2026-111943

N/A

Published 2026-10-21 · Last modified 2026-10-21

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 22nd percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

—CVSS · not scored

  • No impact metrics

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Go Standard Library

Products Crypto/X509

Weakness (CWE)

Not classified.

CVSS vector

Not yet scored.

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • stdlib Go

    pkg:golang/stdlib

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.26.10
    • Introduced version (included): 1.27.0-0
    • Fixed boundary (excluded): 1.27.3
    Additional upstream package constraints
    {
  "ecosystem": {
    "imports": [
      {
        "path": "crypto/x509",
        "symbols": [
          "Certificate.Verify"
        ]
      }
    ]
  },
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-6809.json"
  }
}
    Go Vulnerability Database · GO-2026-6809 · Updated 2026-10-21T00:55:56.763143468Z
  • webpki-roots crates.io

    pkg:cargo/webpki-roots

    SEMVER range
    • Introduced version (included): 0.0.0-0
    • Fixed boundary (excluded): 0.26.11
    • Introduced version (included): 0.26.12-0
    • Fixed boundary (excluded): 1.0.10
    Additional upstream package constraints
    {
  "ecosystem": {
    "affected_functions": null,
    "affects": {
      "arch": [],
      "functions": [],
      "os": []
    }
  },
  "database": {
    "categories": [
      "crypto-failure"
    ],
    "cvss": null,
    "informational": null,
    "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0381.json"
  }
}
    RustSec · RUSTSEC-2026-0381 · Updated 2026-10-21T06:30:02.818201920Z
  • rustls-webpki crates.io

    pkg:cargo/rustls-webpki

    SEMVER range
    • Introduced version (included): 0.0.0-0
    • Fixed boundary (excluded): 0.103.16
    • Introduced version (included): 0.104.0-alpha.1
    • Fixed boundary (excluded): 0.104.0-alpha.8
    Additional upstream package constraints
    {
  "ecosystem": {
    "affected_functions": null,
    "affects": {
      "arch": [],
      "functions": [],
      "os": []
    }
  },
  "database": {
    "categories": [
      "crypto-failure"
    ],
    "cvss": null,
    "informational": null,
    "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0382.json"
  }
}
    RustSec · RUSTSEC-2026-0382 · Updated 2026-10-21T00:55:56.763143468Z
  • webpki-root-certs crates.io

    pkg:cargo/webpki-root-certs

    SEMVER range
    • Introduced version (included): 0.0.0-0
    • Fixed boundary (excluded): 0.26.11
    • Introduced version (included): 0.26.12-0
    • Fixed boundary (excluded): 1.0.10
    Additional upstream package constraints
    {
  "ecosystem": {
    "affected_functions": null,
    "affects": {
      "arch": [],
      "functions": [],
      "os": []
    }
  },
  "database": {
    "categories": [
      "crypto-failure"
    ],
    "cvss": null,
    "informational": null,
    "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0383.json"
  }
}
    RustSec · RUSTSEC-2026-0383 · Updated 2026-10-21T06:30:02.691648061Z

Vendor product assessments

Showing 32 of 1767 vendor product statements; 1735 omitted. Read the full vendor advisory.

  • delve-0:1.26.1-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • grafana-selinux-0:10.2.6-28.el10_2.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2.8?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • criu-0:3.18-5.module+el8.10.0+25171+d379b437.ppc64le (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.10.0%2B25171%2Bd379b437?arch=ppc64le&rpmmod=container-tools:rhel8:8100020261023082046:afee755d

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • oci-seccomp-bpf-hook-debugsource-0:1.2.10-4.module+el8.10.0+25171+d379b437.ppc64le (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.10.0%2B25171%2Bd379b437?arch=ppc64le&rpmmod=container-tools:rhel8:8100020261023082046:afee755d

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • golang-tests-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.6.0%2B25114%2B90ecdb41?arch=noarch&rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • grafana-debuginfo-0:9.0.9-14.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • grafana-pcp-0:5.1.1-15.el9_6.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_6.2?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • git-sync-0:4.7.1-0.3.hum1@src as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • oauth2-proxy-0:7.15.5-0.3.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:7fc7ac36a0e860ac6e7205d9b9ce6745f8fbfbfc155cbdf5516400dd15a6c58a_s390x as a component of Red Hat OpenShift Builds 1.8.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/openshift-builds-image-processing-rhel9@sha256%3A7fc7ac36a0e860ac6e7205d9b9ce6745f8fbfbfc155cbdf5516400dd15a6c58a?arch=s390x&repository_url=registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9&tag=1792742957

    • vendor fix: It is recommended that existing users of Red Hat OpenShift Builds 1.8.z upgrade to 1.8.3 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:b585a15d886cec86d2b36a5b4ab763730f666ba59145fbc716f023280685a619_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11 · fixed

    Vendor assessment for this product only.

    pkg:oci/tempo-rhel9@sha256%3Ab585a15d886cec86d2b36a5b4ab763730f666ba59145fbc716f023280685a619?arch=ppc64le&repository_url=registry.redhat.io/rhosdt/tempo-rhel9&tag=1792610881

    • vendor fix: For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • ansible-automation-platform/automation-orchestrator-operator-bundle as a component of Ansible Automation Orchestrator 2026 · known affected

    Vendor assessment for this product only.

    pkg:oci/automation-orchestrator-operator-bundle?repository_url=registry.redhat.io/ansible-automation-platform/automation-orchestrator-operator-bundle

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • openshift-pipelines/pipelines-triggers-core-interceptors-rhel8 as a component of OpenShift Pipelines · known affected

    Vendor assessment for this product only.

    pkg:oci/pipelines-triggers-core-interceptors-rhel8?repository_url=registry.redhat.io/openshift-pipelines/pipelines-triggers-core-interceptors-rhel8

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • redhat-certification-cnf.src as a component of Red Hat Certification Program for Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • osbuild-composer as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/osbuild-composer

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • buildah.src as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/buildah?arch=src

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • podman-plugins as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/podman-plugins

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • microshift-cert-manager as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/microshift-cert-manager

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • openshift-kuryr.src as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/openshift-kuryr?arch=src

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • toolbox as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/toolbox

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • rhoso-operators/horizon-rhel9-operator as a component of Red Hat OpenStack Platform 18.0 · known affected

    Vendor assessment for this product only.

    pkg:oci/horizon-rhel9-operator?repository_url=registry.redhat.io/rhoso-operators/horizon-rhel9-operator

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • golang-github-danielqsj-kafka_exporter.src as a component of streams for Apache Kafka 3 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • golang-github-openprinting-ipp-usb-0:0.9.27-7.el10_2.4.src as a component of Red Hat Enterprise Linux AppStream (v. 10) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_2.4?arch=src

    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • ipp-usb-debuginfo-0:0.9.27-7.el10_2.4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_2.4?arch=ppc64le

    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • automation-gateway-proxy-openssl30.src as a component of Red Hat Ansible Automation Platform 2 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • trustee-kbs as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/trustee-kbs

    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • butane as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not in execute path

    pkg:rpm/redhat/butane

    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • trustee-guest-components.src as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • butane.src as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]_2?arch=src

    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • containernetworking-plugins.src as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not in execute path

    pkg:rpm/redhat/containernetworking-plugins?arch=src

    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • golang-github-streadway-amqp-devel as a component of Red Hat OpenStack Platform 16.2 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not in execute path

    pkg:rpm/redhat/golang-github-streadway-amqp-devel

    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00
  • etcd.src as a component of Red Hat OpenStack Platform 18.0 · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/etcd?arch=src

    Red Hat · CVE-2026-111943 · Updated 2026-10-26T13:39:34+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

5 candidates

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS