Go Blocks Compromised eMudhra CA Keys in Emergency Update

The Go team released emergency updates late Monday that caused the language’s certificate verifier to reject eight intermediate certificate authority keys, which Mozilla and Google later confirmed belonged to the Indian CA eMudhra and had been compromised.

Go 1.27.3 and Go 1.26.10 carry a single security fix in the crypto/x509 package, tracked as CVE-2026-111943 and Go issue 82345, and the Go team urged users to upgrade immediately. The Go project does not assign CVSS scores to its vulnerabilities. Its policy says severity depends too heavily on how an API is used.

The release announcement did not name the certificate authority. It said only that Go was blocking trust in a small set of intermediates over “specific security concerns around their operation.” The issue was handled on Go’s URGENT track. Go reserves that track for threats to the ecosystem’s integrity or actively exploited flaws, and it triggers an immediate release that may skip the usual pre-announcement.

The commit lists only SHA-256 hashes of the keys. Within hours, a contributor on the Go issue matched all eight to eMudhra intermediates. Another user noted that CCADB, the shared database root programs use, showed them as revoked due to a CA compromise on October 18 and 19.

The match was confirmed on Tuesday. Mozilla disclosed that it had received a report on Saturday, October 17, at 20:06 UTC that private keys for eight eMudhra intermediate certificates had been compromised, keys that could let attackers issue fraudulent HTTPS certificates for sites they do not control. A disclosure site maintained by Mozilla’s Dennis Jackson lists Go 1.27.3 and 1.26.10 as the patched releases for the incident.

How were the eMudhra keys exposed?

The reporter, identified only as Wayne, proved the compromise by signing a message with each of the eight private keys and sending it to the root program teams on October 17. The message read “We have a problem here – Wayne.” The signatures, certificates, and public keys are published in a proof archive anyone can verify with OpenSSL.

How the keys were obtained has not been disclosed. Asked whether other CAs could be exposed, Mozilla said it does not currently believe the issue affects them. Cyber Kendra found no public statement from eMudhra as of Tuesday.

Six of the keys belong to TLS intermediates issued under emSign Root TLS CA – G3. These are the DV, OV, and EV issuing CAs, each in a G3B version held by eMudhra BV in the Netherlands and a G3C version held by eMudhra Inc in the US. The other two are code-signing intermediates, EM OV CS CA – G3B and G3C, under emSign Root CS CA – G3.

The browsers moved first. Chrome received the report at 18:05 UTC on October 17 and pushed a CRLSet update blocking all six TLS keys by 19:45 UTC. CRLSet is Chrome’s remotely updated block list. Mozilla finished distributing its OneCRL block to Firefox by 22:59 UTC the same day. Apple blocked the certificates on October 19, and Microsoft on October 20.

Chrome said that no TLS certificate chaining to the six intermediates had been logged in Certificate Transparency before its block, so no fraudulent certificates from them could have been trusted by default in CT-enforcing browsers. Mozilla also said that no public TLS server certificates had been issued under the affected roots, aside from internal test certificates.

Go needed a code change because its verifier performs no revocation checks and does not read browser blocklists such as CRLSets. A revoked intermediate, therefore, stays trusted by Go programs until the trust decision ships in a new release. Programs keep the old behaviour until they are rebuilt with it.

The new filter hashes each certificate’s public key rather than the certificate itself. That matters here because Sectigo issued cross-certificates that share the same compromised keys, and a key-level block catches those copies as well. The check runs in Go’s own verifier and in the macOS and Windows code paths that hand verification to the operating system. The commit adds no setting to switch it off.

What should developers and trust store operators do?

Teams should move to Go 1.27.3 or 1.26.10, then rebuild and redeploy the affected binaries. Go 1.25 and older are out of support and receive no fixes. Bluesky and the gRPC health probe project were among those that rebuilt on the new releases on Tuesday.

Other ecosystems are shipping the same block. The disclosure site lists fixes in Electron 44.9.1, 43.8.1, and 42.11.16; Python’s certifi 2026.10.19; Rust’s webpki-roots 1.0.10; and NSS 3.131.1, with Node.js and Composer’s ca-bundle still pending. Mozilla also released Firefox 158.0.1, Firefox ESR 115.43.1, and ESR 153.5.1 for users whose settings kept them from receiving the OneCRL update.

Mozilla advised trust store operators that can block individual intermediates to block the listed certificates immediately, and others to consider removing the eMudhra roots. NSS 3.131.1 already removes the root that signed the intermediates, which Mozilla warned will cut off some servers for non-Firefox users until they move to new chains.

Chrome said Chrome Root Store version 43 will soon drop the upstream eMudhra root. Citing the seriousness of the incident, Chrome said it is also evaluating the status of eMudhra’s remaining CA certificate.