CVE-2026-111943 Go standard library CVE debrief

Who should care

Defenders responsible for maintaining and updating the webpki-roots package, as well as operators and security teams, should assess exposure and prioritize verification and remediation efforts. This includes reviewing certificate paths and intermediates for potential vulnerabilities, and ensuring that the dependency is updated to 1.0.10 or newer to mitigate the risk. Affected platforms and systems may be at risk if not properly addressed.

Why it matters

Defenders should care about CVE-2026-111943 because it affects the webpki-roots package, potentially allowing trust in distrusted emSign intermediates. This could lead to security risks if not properly addressed. The vulnerability requires verification of the package version and updates to mitigate the risk.

• Potential for accepting untrusted certificate paths
• Risk of compromised intermediates due to well-known private keys
• Need for version verification and dependency updates
• Potential impact on systems relying on webpki-roots for certificate validation

Technical summary

The webpki-roots package contains bundled root certificates, including `emSign ECC Root CA - G3`, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys, as their private keys are now well known. This vulnerability requires verification of the package version and updates to mitigate the risk. Defenders should prioritize verifying the version of webpki-roots in use and ensuring that the dependency is updated to 1.0.10 or newer to mitigate the risk. The vulnerability affects defenders responsible for maintaining and updating the webpki-roots package.

Defensive priority

Defenders should prioritize verifying the version of webpki-roots in use and ensuring that the dependency is updated to 1.0.10 or newer to mitigate the risk.

Recommended defensive actions

• Verify the version of webpki-roots in use and update to 1.0.10 or newer
• Check if the webpki-roots 0.26.11 compatibility package is in use and ensure its 1.x dependency is version 1.0.10 or newer
• Review certificate paths and intermediates for potential vulnerabilities
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The source item from osv_dev provides details on the vulnerability, including affected versions and the fix in version 1.0.10. The CVE Program and NVD records offer additional context. Additional review of the vulnerability details and source grounding indicate that defenders should verify certificate paths and intermediates for potential vulnerabilities, and ensure that the dependency is updated to 1.0.10 or newer to mitigate the risk.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.