/
← Voltar ao feed
high technology

Go 1.27.3/1.26.10 emergency release blocks eight eMudhra intermediate CA keys over undisclosed security concerns

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 08:32 · coletado há 16 horas

On October 20, the Go team released Go 1.27.3 and Go 1.26.10 on its URGENT track. The certificate verifier now rejects any chain passing through one of eight intermediate CA keys, citing unspecified "specific security concerns around their operation." A commenter on the Go issue matched the SHA-256 key hashes to intermediates of the Indian CA eMudhra (emSign brand). Two days earlier, on October 17, Mozilla added six intermediates under emSign Root TLS CA - G3 to OneCRL. Neither Mozilla, Go nor eMudhra has said what prompted the actions, and the Mozilla bug is closed to the public. Whether Chrome, Apple or Microsoft have acted is not established.

Technical Details

  • The filter hashes each certificate's public key, so cross-signed copies of the same key are also caught. It applies in Go's own verifier and in the macOS and Windows code paths that delegate verification to the OS.
  • Rejected chains return x509: no valid chains built. There is no setting to disable the filter, and it appears to apply even when a program supplies its own trusted roots, so private deployments trusting these keys will also fail. Go has not said whether this is intended.
  • By the commenter's matching, which The Hacker News did not independently verify, six keys are TLS intermediates (DV, OV and EV, G3B and G3C variants) under emSign Root TLS CA - G3, and two are code-signing intermediates (EM OV CS CA - G3B and G3C) under emSign Root CS CA - G3.
  • Go's verifier does no revocation checking and does not read browser block lists such as CRLSets, so blocking requires shipping a release. Programs keep the old behavior until rebuilt. Bluesky's indigo was rebuilt on October 20.
  • Go's policy reserves the URGENT track for threats to ecosystem integrity or actively exploited severe flaws. Go has not said which applied, and unlike its October 8 security releases, this one had no pre-announcement.
  • eMudhra's roots emSign Root CA - G1 and emSign ECC Root CA - G3 are in the Chrome, Apple and Mozilla root stores. The newer TLS root is cross-signed by G1, which is how it chains to a trusted root. A September public discussion on adding ten new eMudhra roots closed with no objections. eMudhra's repository had no notice and no public statement was found.

Remediation

  • Upgrade to a supported Go release (1.27.3 or 1.26.10) and rebuild affected programs. Go 1.25 and older are unsupported and get no fix.
  • No workaround exists. Services whose certificates chain through the eight keys need certificates from a different intermediate before rebuilt Go clients can connect.
  • Check private deployments that intentionally trust these keys, as they will break.

Linha do tempo

  1. thehackernews.com ↗ · pub. 20/10/2026 08:32 · coletado 20/10 10:00 primeiro registro

    Go 1.27.3/1.26.10 emergency release blocks eight eMudhra intermediate CA keys over undisclosed security concerns

    ler a análise desta fonte

    On October 20, the Go team released Go 1.27.3 and Go 1.26.10 on its URGENT track. The certificate verifier now rejects any chain passing through one of eight intermediate CA keys, citing unspecified "specific security concerns around their operation." A commenter on the Go issue matched the SHA-256 key hashes to intermediates of the Indian CA eMudhra (emSign brand). Two days earlier, on October 17, Mozilla added six intermediates under emSign Root TLS CA - G3 to OneCRL. Neither Mozilla, Go nor eMudhra has said what prompted the actions, and the Mozilla bug is closed to the public. Whether Chrome, Apple or Microsoft have acted is not established.

    Technical Details

    • The filter hashes each certificate's public key, so cross-signed copies of the same key are also caught. It applies in Go's own verifier and in the macOS and Windows code paths that delegate verification to the OS.
    • Rejected chains return x509: no valid chains built. There is no setting to disable the filter, and it appears to apply even when a program supplies its own trusted roots, so private deployments trusting these keys will also fail. Go has not said whether this is intended.
    • By the commenter's matching, which The Hacker News did not independently verify, six keys are TLS intermediates (DV, OV and EV, G3B and G3C variants) under emSign Root TLS CA - G3, and two are code-signing intermediates (EM OV CS CA - G3B and G3C) under emSign Root CS CA - G3.
    • Go's verifier does no revocation checking and does not read browser block lists such as CRLSets, so blocking requires shipping a release. Programs keep the old behavior until rebuilt. Bluesky's indigo was rebuilt on October 20.
    • Go's policy reserves the URGENT track for threats to ecosystem integrity or actively exploited severe flaws. Go has not said which applied, and unlike its October 8 security releases, this one had no pre-announcement.
    • eMudhra's roots emSign Root CA - G1 and emSign ECC Root CA - G3 are in the Chrome, Apple and Mozilla root stores. The newer TLS root is cross-signed by G1, which is how it chains to a trusted root. A September public discussion on adding ten new eMudhra roots closed with no objections. eMudhra's repository had no notice and no public statement was found.

    Remediation

    • Upgrade to a supported Go release (1.27.3 or 1.26.10) and rebuild affected programs. Go 1.25 and older are unsupported and get no fix.
    • No workaround exists. Services whose certificates chain through the eight keys need certificates from a different intermediate before rebuilt Go clients can connect.
    • Check private deployments that intentionally trust these keys, as they will break.