CVE-2026-111943Go crypto/x509 trusts the compromised intermediates
Go's root and intermediate handling accepted the weak eMudhra chain. Fixed in Go 1.27.3 and 1.26.10; no fix for 1.25 and older.
eMudhra: eight CA keys you could guess on a pocket calculator
eMudhra CA intermediate private keys were so weak that every one was a number below 256
Eight intermediate certificates (six TLS, two code signing) under emSign ECC Root CA - G3, cross-signed by Sectigo, had P-384 private keys that were integers below 256. Anyone could recover them instantly and mint certificates for any domain.
- Disclosed
- Oct 17, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- 2 CVEs tracked here
- Splash zone
- Anything trusting emSign ECC Root CA - G3 or the Sectigo cross-signs: browsers, OSes, Go, Python, Node
- go · python · node · browsers
- In the wild
- Not seen
- No end-entity certs found in CT logs; blocked within hours
The one-sentence version
A certificate authority's key is supposed to be a 384-bit secret; these were numbers you could count to on your fingers and toes, so anyone could sign “trusted” certificates for any website.
What happened
A certificate authority’s private key is the thing that makes “this is really your bank” true. For eight eMudhra intermediate certificates, the P-384 private keys were integers below 256. One of them, according to researcher Scott Helme, was literally the number 4. Anyone who noticed could have signed a certificate for any domain, and every client trusting the chain would have believed it.
The intermediates sat under emSign ECC Root CA - G3 and were cross-signed by Sectigo, which widened who trusted them. Six were TLS CAs and two were code-signing CAs that Microsoft trusted. eMudhra blames a key wrap/unwrap flaw that produced a weak batch of keys.
Why L4 and not L5
A broken trust anchor is normally a Shitstorm. We graded it down after the review:
- There is no sign that anyone abused it. Certificate Transparency logs show no end-entity certificates from these intermediates.
- Browsers blocked them within hours of the report, and every major platform followed within three days.
The long tail is the real risk: language runtimes, Java cacerts, appliances and old containers that
still carry the old bundle.
There is one open question. The Mozilla bug mentions roughly 30,000 subscriber certificates to migrate, which conflicts with eMudhra’s statement that no end-entity certificates were issued from these keys.
What’s in the bowl
CVE-2026-113470Firefox trusts the compromised intermediates
Firefox fix that distrusts the eight intermediates and removes the root.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Go | 1.27.3 / 1.26.10 | CVE-2026-111943. Go 1.25 and older get no fix |
| Python certifi | 2026.10.19 | |
| Node.js | 22.23.4 / 24.22.1 / 26.12.1 | Ships NSS 3.131.1 CA bundle |
| Mozilla NSS | 3.131.1 | Root removed Oct 20 |
| Cloudflare WARP / 1.1.1.1 / cloudflared | 2026.10.2 | |
| Java (cacerts) | unknown | Not covered by sources we reviewed. Check your vendor |
Crime-scene timeline
Apr 30, 2025
The keys are generated, in a batch of 24 intermediates
Oct 17, 2026
A researcher reports to Chrome (18:05 UTC) and Mozilla (20:06 UTC)
Chrome CRLSet blocks the six TLS intermediates by 19:45 UTC; Mozilla OneCRL by 22:59 UTC. Mozilla recovers the keys itself.
Oct 18, 2026
All eight revoked as caCompromise
Per the Mozilla bug. eMudhra's own statement dates the revocation to Oct 19.
Oct 19, 2026
Apple and Android block the certificates; certifi ships a fix
Oct 20, 2026
Microsoft blocks them; Go releases fixes; NSS removes the root
Oct 21, 2026
Node.js security release rejects the keys
~Oct 27, 2026
Chrome Root Store v43 removes the emSign ECC Root CA - G3
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Mozilla Bugzilla 2083449PrimaryKeys are integers below 256; report times, OneCRL entries and revocation on Oct 18
- eMudhra statementPrimaryBlames a key wrap/unwrap flaw; says 7 were never used in production and the 8th issued no certificates
- The Hacker NewsQuotes Scott Helme that one key was literally 4; vendor block timeline
- BleepingComputerBrowser and OS vendor response