CVE-2026-111943 is a weak-key compromise affecting eight intermediate certificate authority certificates whose private keys were generated with only single-digit or double-digit integer values instead of the required 384-bit pseudo-random entropy. The affected component is the Go programming runtime’s X.509 chain verification engine in environments that rely on embedded or legacy root certificate pools and do not honor certificate revocations. No specific affected version range is stated. An attacker who obtains or can derive one of the compromised intermediate private keys can issue fraudulent certificates for arbitrary websites or services, enabling server impersonation, traffic interception, and modification when a client trusts the affected chain. The business impact extends beyond web browsers to VPNs, proxies, load balancers, gateways, build runners, package managers, industrial IoT, and embedded systems that validate TLS or code-signing chains through separate trust stores, because fraudulent certificates may be accepted if revocation or distrust controls are absent. The exposure can undermine trust in public key infrastructure, expose sensitive communications, and create supply-chain risk when software fetches content over TLS while still trusting an affected key.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-111943 is a weak-key compromise affecting eight intermediate certificate authority certificates whose private keys were generated with only single-digit or double-digit integer values instead of the required 384-bit pseudo-random entropy. The affected component is the Go programming runtime’s X.509 chain verification engine in environments that rely on embedded or legacy root certificate pools and do not honor certificate revocations. No specific affected version range is stated. An attacker who obtains or can derive one of the compromised intermediate private keys can issue fraudulent certificates for arbitrary websites or services, enabling server impersonation, traffic interception, and modification when a client trusts the affected chain. The business impact extends beyond web browsers to VPNs, proxies, load balancers, gateways, build runners, package managers, industrial IoT, and embedded systems that validate TLS or code-signing chains through separate trust stores, because fraudulent certificates may be accepted if revocation or distrust controls are absent. The exposure can undermine trust in public key infrastructure, expose sensitive communications, and create supply-chain risk when software fetches content over TLS while still trusting an affected key.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]