← Tuesday, October 20, 2026SecurityVulnerability

Go will reject certificate chains containing eight distrusted SPKIs

github.com 4 min read Editor score 7/10

Go’s crypto/x509 verification will filter out chains containing a small set of distrusted intermediate certificates. Services that rely on Go’s verifier should upgrade to avoid trusting those chains.

What

Go’s crypto/x509 package will distrust a small set of intermediate certificates over concerns about their operation.

How

Certificate verification now filters out chains containing those intermediates so they are not returned to callers.

Why it matters

The issue is marked an urgent security release blocker, and Go recommends upgrading promptly to receive the mitigation.

Read on github.com → Hacker News · 17 comments

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.