If you write Go programs that talk to anything over HTTPS, this one is for you. On October 19, 2026, the Go team released Go 1.27.3 and Go 1.26.10. Both contain a single security fix, in the crypto/x509 package, according to the release history.
What happened
The Go team explained the story a week later in Our Response To The eMudhra Key Disclosure Incident. In short: some intermediate certificates from a certificate authority called eMudhra turned out to have extremely weak keys. Their private keys could be recovered very quickly. Since the eMudhra root was widely trusted, someone with those keys could have signed a certificate for any website and pretended to be it.
Go’s fix blocks trust in that small set of intermediate certificates. The announcement on golang-announce tracks it as CVE-2026-111943 and Go issue 82345. The Go vulnerability database lists it as GO-2026-6809, affecting Certificate.Verify in versions before go1.26.10, and go1.27.x before go1.27.3.
According to the blog post, this was the first ever URGENT-track security release for Go, and patched releases were out in under seven and a half hours after the team was notified.
Why a beginner should care
Here’s the part that trips people up. Go compiles everything into a single binary, including the standard library. So updating Go on your machine doesn’t fix programs you already built. You have to rebuild them with the new toolchain. The blog post says rebuilt binaries automatically reject certificates from the compromised intermediates.
That applies to anything that makes TLS connections: code using net/http or crypto/tls directly, and dependencies built on them, like gRPC. The blog also notes that on Linux, Go uses its own certificate verifier, while on Windows and macOS it relies on the platform, so Linux servers are where this fix matters most.
What to do
First, check which Go you have, and which Go a program was built with:
go version
go version -m ./myprogramCode language: Bash (bash)If you see anything older than go1.27.3 or go1.26.10, download a fresh release from go.dev/dl, then rebuild and redeploy your programs. You can also scan a compiled binary with govulncheck, which the Go team recommends in the blog post:
govulncheck -mode=binary ./myprogramCode language: Bash (bash)I’d make this a habit, not a one-time thing. Point releases come out regularly, and many of them include security fixes. For example, Go 1.27.2 and 1.26.9, released October 8, had security fixes to the go command and packages like crypto/tls, html/template and net/http. Staying on the latest point release of your Go version is one of the easiest ways to keep your programs safe.