Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns

Summary: Go 1.27.3 and Go 1.26.10, released October 20, make Go's certificate verifier reject any chain passing through one of eight intermediate CA keys belonging to a single unnamed certificate authority, citing "specific security concerns around their operation" and shipping on Go's URGENT track. Two days earlier Mozilla added six eMudhra emSign Root TLS CA - G3 intermediates to OneCRL, and a commenter matched all eight Go hashes to eMudhra intermediates, though The Hacker News has not independently verified the hashes.
What's compelling: The filter has no off switch and, given the code's structure, applies even when a program supplies its own trusted roots, so a private deployment that intentionally trusts one of the eight keys will fail until it is rebuilt on a supported release. Go 1.25 and older get no fixes, and the CA itself has issued no public statement.

Read the original at The Hacker News ↗