Go will reject certificate chains containing eight distrusted SPKIs
Summary
Go has implemented a mitigation for security concerns around a specific Certificate Authority (CVE-2026-111943). The change blocks trust in a small set of intermediate certificates by filtering out chains containing these intermediates, preventing them from being returned to the caller. Upgrade to the affected Go release is highly recommended to protect applications that rely on x509 certificate verification.