Vulnerability GO-2026-6809
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 hours ago
October 21, 2026 at 12:27 AM UTC
Distrust compromised intermediate certificates in crypto/x509
<1.26.10, >=1.27.0-0 <1.27.3
<1.26.10, >=1.27.0-0 <1.27.3
Summary
Distrust compromised intermediate certificates in crypto/x509
Details
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.
To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
12 days ago
Reset context tracking on consecutive template expressions in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
Unknown
12 days ago
Recognize yield as regexp preceder keyword in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
Unknown
12 days ago
HTTP/2 server memory exhaustion due to Trailer headers in net/http
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
Unknown
12 days ago
Root.Mkdir(All) can follow junctions out of the root on Windows in os
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6604
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6604
Unknown
12 days ago
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6605
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6605
Impacted packages
Timeline
Published
2 hours ago
October 21, 2026 at 12:27 AM UTC
Last Modified
2 hours ago
October 21, 2026 at 12:55 AM UTC