Go Certificate Validation Flaw Could Enable Man-in-the-Middle Attacks
The Go standard library's crypto/x509 package has a vulnerability (CVE-2026-111943) where certificate validation fails to block intermediate certificates linked to compromised CAs, allowing attackers to impersonate legitimate servers in man-in-the-middle attacks. Red Hat has rated it "Important" with a CVSS 3.1 score of 6.8.
Go Certificate Validation Vulnerability Could Enable Man-in-the-Middle Attacks
A vulnerability, CVE-2026-111943, exists in the crypto/x509 package of the Go programming language. The certificate validation fails to prevent trust in intermediate certificates associated with a compromised Certificate Authority (CA), allowing attackers to impersonate legitimate servers and conduct man-in-the-middle attacks. Red Hat has rated this vulnerability as Important, with a CVSS 3.1 score of 6.8.
Exploitation requires a specific network position and a certificate issued by an untrusted intermediate authority. Red Hat states that large-scale abuse is unlikely. Mitigation steps are detailed in the security advisory.