Conversation

New Go security releases added explicit distrust for some specific intermediate CA certificates belonging to eMudhra Technologies Limited. Interestingly, this is tracked as CVE-2026-111943 but no details on why this was done are provided.

https://github.com/golang/go/commit/7f86f957633ee31a1c17a1eb8452ca7a3d9bc141

#pki #CVE_2026_111943 #infosec #cybersecurity

While no official word is out yet, it is not difficult to speculate that the private keys have likely been leaked.

The curious part is that various downstream projects need to take this action rather than the issue being solved upstream.