Multiple security vulnerabilities have been identified in Go, affecting version 1.25. The issues involve Go's trust in compromised intermediate certificate authority private keys that could allow an attacker to issue certificates for arbitrary websites or code-signing targets. This creates a high risk to TLS trust and software integrity for systems that rely on the affected trust material. The compromise affects both web and code-signing certificate paths, increasing the potential for impersonation and supply-chain attacks.
CVE-2026-111943: The vulnerability affects Go version 1.25 and concerns trust in compromised intermediate certificate authority private keys. An attacker holding such a key could issue certificates that the affected software would accept.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Go, affecting version 1.25. The issues involve Go's trust in compromised intermediate certificate authority private keys that could allow an attacker to issue certificates for arbitrary websites or code-signing targets. This creates a high risk to TLS trust and software integrity for systems that rely on the affected trust material. The compromise affects both web and code-signing certificate paths, increasing the potential for impersonation and supply-chain attacks.
CVE-2026-111943: The vulnerability affects Go version 1.25 and concerns trust in compromised intermediate certificate authority private keys. An attacker holding such a key could issue certificates that the affected software would accept.[emaillocker id="1283"]
CVE-2026-113470: The vulnerability affects Go version 1.25 and concerns trust in compromised intermediate certificate authority private keys. An attacker holding such a key could issue certificates that the affected software would accept.
These vulnerabilities collectively present a serious risk to the integrity of certificate-based trust, especially for deployments that rely on the affected software for secure connections or signed content. Users of the affected version are most at risk because an attacker with the compromised keys could impersonate trusted services or distribute malicious signed material. Affected organizations should assess exposure and monitor for unauthorized use of the compromised trust material.
The following reports contain further technical details:
[/emaillocker]