CVE-2026-111943: CWE-299: Improper Check for Certificate Revocation in Go standard library crypto/x509

The Go standard library's crypto/x509 package relies on system root certificates for verifying TLS certificates. However, on certain platforms or scenarios, system trust stores may not be updated promptly, leading to acceptance of revoked or untrustworthy intermediate certificates. To address this, the Go maintainers introduced a denylist mechanism in crypto/x509 that returns an error during certificate verification if the certificate chain includes any known intermediate certificates that have been revoked or are no longer trusted. This vulnerability is tracked as CVE-2026-111943 and is categorized under CWE-299 (Improper Check for Certificate Revocation).

If untrusted intermediate certificates are accepted due to outdated system trust stores, it could allow attackers to present revoked or malicious certificates that appear valid, potentially undermining TLS security. However, the impact is limited to narrower cases where system trust stores are not updated automatically. No known exploits are reported in the wild.

A fix is available in Go versions 1.26.10 and 1.27.3 and later, which include the denylist to reject untrustworthy intermediate certificates during verification. Users should upgrade to these or later versions to ensure proper certificate revocation checks. No additional vendor advisory content is provided, so patch status is based on the affectedVersions field indicating fixed versions.