Running a controlled response to CVE-2026-111943 without weakening TLS checks

A patched Go binary can start failing TLS connections when a chain contains one of the eight compromised eMudhra intermediates. That failure is expected behavior. The response should replace the untrusted link or the affected build, not add a code path that accepts every certificate.

CVE-2026-111943 affects Go crypto/x509 in versions before go1.26.10 and from go1.27.0-0 before go1.27.3 . The fixed releases are go1.26.10 and go1.27.3 . Mozilla reported that the compromised intermediate private keys could be used to issue fraudulent HTTPS certificates. The Go patch computes SHA-256 SPKI hashes and rejects certificate chains containing any of the eight blocked keys.

What operators may see

After upgrading, a Go client may return x509: certificate signed by unknown authority or a related NoValidChains failure. The exact message depends on the call path and surrounding code. A generic handshake error can obscure the cause.…