Affected Systems

Go versions 1.27.3 and 1.26.10 (released October 20, 2026). All Go programs must be rebuilt with these versions to enforce the block. Eight intermediate CA keys from eMudhra (six TLS, two code-signing) under emSign Root TLS CA - G3 and emSign Root CS CA - G3 are blocked. Go 1.25 and older are unsupported and receive no fix.

Exploitation Status

Undisclosed. Go classified this as URGENT track, reserved for active exploitation with severe damage or threats to ecosystem integrity. Mozilla simultaneously added six eMudhra intermediates to Firefox block list (OneCRL) on October 17. No public details on root cause or exploitation evidence.

Business Impact

Go applications will reject TLS connections and code-signing certificates chaining through the eight blocked eMudhra intermediates, returning "x509: no valid chains built" errors. This affects any service or site using certificates issued by these intermediates. The block cannot be disabled, even for private deployments intentionally trusting these keys. Applications must be rebuilt with patched Go versions to enforce the block. Services using affected certificates must reissue from different intermediates before patched Go clients can connect. Chrome, Apple, and Microsoft actions unknown as of October 20.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade to Go 1.27.3 or 1.26.10 immediately from the official download page and rebuild all Go applications to enforce the CA key block.
  • Inventory all Go-based services and clients in your environment and prioritize rebuilds based on exposure to external certificate chains.
  • Test rebuilt applications against known endpoints to identify services using eMudhra-issued certificates (EM DV/OV/EV TLS CA - G3B/G3C intermediates).
  • Contact vendors or service providers if rebuilt Go clients fail with 'x509: no valid chains built' errors; request certificate reissuance from non-blocked intermediates.
  • Monitor Go security announcements and Mozilla/Chrome root program discussions for public disclosure of the underlying security concern.