Go 1.26.10 and 1.27.3 block eight compromised CA certificates
eMudhra had eight emSign intermediates revoked for suspected compromise on 18 October. Go patched crypto/x509 within two days to reject any chain that still uses them.
Go shipped emergency patches on 20 October that make crypto/x509 reject TLS certificate chains signed by eight eMudhra intermediate certificates, after the certificate authority had them revoked for suspected compromise. The intermediates sit under eMudhra’s emSign Root TLS CA - G3 and emSign Root CS CA - G3 hierarchies, and CCADB logged them as cACompromise on 18 and 19 October.
The fix lands in Go 1.26.10 and 1.27.3, tracked as CVE-2026-111943 and marked urgent. From these releases on, Verify silently filters out any certificate chain that still routes through one of the eight intermediates rather than returning it to the caller, so affected connections fail closed instead of validating against a certificate authority Go no longer trusts.
Why it matters: this is a trust-store fix, not something you can code around, so the only way to get the protection is to upgrade. If your Go service does outbound TLS verification at all, which is most of them, 1.26.10 and 1.27.3 are worth treating as a priority patch rather than routine version creep.
The caveat: eMudhra’s certificates are mostly issued in India and to government-adjacent services, so unless something in your chain actually depends on them, the upgrade will be invisible beyond the version bump.