Eight eMudhra intermediate CA keys compromised; browsers block them
Chrome and Firefox blocked the TLS intermediates within hours of an October 17 report, and no website certificate chaining to them was in Certificate Transparency beforehand.
86
CVE-2026-111943
- CVSS
- —
- EPSS
- <1%p3
- Published
- ·
- Modified
Description · NVD
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
In the news
4 storiesWeak eMudhra intermediate keys can impersonate sites; vendors block them
Go 1.27.3 and 1.26.10 distrust eight weak intermediates as CVE-2026-111943; Talos reports no malicious use yet.
78
Mozilla, Google and Apple block compromised eMudhra certificates
Eight April 2025 intermediates used private keys smaller than 256; no abuse is evidenced, but many trust stores needed updates.
74
NVD lists CVE-2026-111943 as a compromised intermediate CA
The captured NVD page is only site chrome, so vendor, versions, severity, and impact are not in the text.
42