Go distrusts intermediates by SPKI hashes to fix CVE-2026-111943
Summary
Go's x509 system now distrusts certain intermediates identified by distrusted SPKI hashes when verifying certificate chains. The change, tied to CVE-2026-111943, filters out chains containing these SPKIs and returns an appropriate error if no valid chains remain. This hardens TLS verification in Go and may require upgrading to a newer Go version to benefit from the fix.