VDB
RHSA-2026:86972
RHSA-2026:86972
PUBLISHED
CVSS 6.800000190734863 MEDIUM
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | grafana-pcp-0:5.1.1-10.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 5.1.1-10.el9 |
| Red Hat | grafana-pcp-debugsource-0:5.1.1-10.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 5.1.1-10.el9 |
| Red Hat | grafana-pcp-debuginfo-0:5.1.1-10.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 5.1.1-10.el9 |
| Red Hat | grafana-pcp-0:5.1.1-10.el9_4.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 5.1.1-10.el9 |
| Red Hat | grafana-pcp-debugsource-0:5.1.1-10.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 5.1.1-10.el9 |
| Red Hat | grafana-pcp-0:5.1.1-10.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 5.1.1-10.el9 |
| Red Hat | grafana-pcp-debuginfo-0:5.1.1-10.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 5.1.1-10.el9 |
| Red Hat | grafana-pcp-debugsource-0:5.1.1-10.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 5.1.1-10.el9 |
| Red Hat | grafana-pcp-debuginfo-0:5.1.1-10.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 5.1.1-10.el9 |
| Red Hat | grafana-pcp-0:5.1.1-10.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 5.1.1-10.el9 |
| Red Hat | grafana-pcp-debuginfo-0:5.1.1-10.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 5.1.1-10.el9 |
| Red Hat | grafana-pcp-debugsource-0:5.1.1-10.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 5.1.1-10.el9 |
| Red Hat | grafana-pcp-0:5.1.1-10.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) | 5.1.1-10.el9 |
Timeline
- Oct 21, 2026 CVE Published
- Oct 22, 2026 CVE Updated
- Oct 22, 2026 Distribution Patch
- Oct 22, 2026 Distribution Patch
- Oct 22, 2026 Security Advisory
- Oct 22, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:86972 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2556068 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86972.json advisory
- https://access.redhat.com/security/cve/CVE-2026-111943 advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2026-012 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-111943 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-111943 advisory
- https://github.com/golang/go/issues/82345 advisory
- https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU advisory