Go Patches Eight eMudhra CA Keys After Mozilla Finds Them Trivially Recoverable

The Go programming language team released versions 1.27.3 and 1.26.10 on 19 October 2026, hard-coding a block on eight intermediate certificate authority keys into the standard library's crypto/x509 package, according to the golang-announce security release. The fix, tracked as Go issue 82345 and assigned CVE-2026-111943, makes the Verify function reject any certificate chain that passes through one of the eight keys. The Go team put the issue on its "urgent" track, the one reserved for its most serious fixes, and urged developers to upgrade immediately.

The keys belong to intermediate certificate authorities operated by the Indian CA eMudhra under its emSign brand. A Mozilla incident report filed as Bugzilla bug 2083449 describes what went wrong: the eight P-384 elliptic-curve private keys, issued under a batch dated 30 April 2025, were not drawn from the full range of possible values. "P384 private keys are randomly selected integers between 1 and the group order," the report states. "The 8 impacted keys all used integers less than 256." That left the keys effectively recoverable by brute force, the report says, "via the baby-step giant-step discrete log algorithm or more simplistically by just generating the 'first' 256 P384 keys."

The report credits an external security researcher with the initial finding, submitted to Mozilla on 17 October 2026 at approximately 20:05 UTC. Mozilla says it independently recovered the private keys itself by 21:48 UTC that day, "without any knowledge of the method the original reporter used, confirming the key generation process was flawed and is trivial to exploit." The bug report adds that a Mozilla engineer, Dennis Jackson, separately demonstrated the weakness by having AI agents recover a key "on their first attempt with a simplistic prompt."

What the certificates could have been used for

Six of the eight affected intermediates issued ordinary TLS certificates, the kind that authenticate HTTPS websites; the other two issued code-signing certificates. A party holding one of the recoverable private keys could, in principle, have signed a certificate for a domain it did not control, or signed software it did not write, and had that certificate accepted as valid by any system that still trusted the eMudhra intermediate. The Mozilla bug report's timeline records eMudhra revoking all eight certificates for "caCompromise" at 09:38 UTC on 18 October 2026, with Mozilla filing its formal incident report at 12:06 UTC the same day.

Mozilla blocked the eight intermediates in Firefox through its OneCRL revocation list by 22:59 UTC on 17 October 2026, according to the bug report, which also notes that Chrome's root program received its own notice of the compromise earlier that day, at 18:05 UTC. The Go announcement does not name eMudhra directly or describe the weak-key-generation flaw; it refers only to "specific security concerns around their operation" and states that "Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller." On the GitHub issue, Go security team member Roland Shoemaker explained the vagueness: "Our priority was two-fold, first to release a safe Go version as quickly as possible," and the team "didn't want to immediately disclose the underlying issue due to the ease of exploitation."

Why rebuilding matters, not just upgrading

Because Go compiles the standard library's certificate-verification logic directly into each binary, the fix only takes effect once a program is recompiled against 1.27.3 or 1.26.10. Installing the new Go toolchain on a build server has no effect on services that are not subsequently rebuilt and redeployed, a distinction the Go team stressed in pushing for immediate action rather than a routine patch cycle.

The near-simultaneous notices to Mozilla and Chrome's root programs on 17 October, followed by eMudhra's own revocation the next day and Go's backported fix two days after that, show how a single flawed key-generation batch from April 2025 propagated through independent trust stores and language runtimes once its structure became known. Each of those programs verified the weakness on its own rather than relying on another's word, which is why the Mozilla report stresses that its team recovered the keys "without any knowledge of the method the original reporter used."

What it means for students and developers

For students of cryptography and systems security, the eMudhra incident is a concrete case of a failure mode usually discussed in the abstract: a certificate authority's key-generation process producing private keys with far less entropy than their key size implies, collapsing a 384-bit elliptic-curve key down to a search space of 256 integers. For developers, it is a reminder that a dependency's trust assumptions — in this case, which certificate authorities a language runtime trusts by default — can change on short notice and require redeploying already-built software, not just patching source code. The Go issue tracker shows the fix landing within two days of the first report reaching a root-store operator, a pace set by how easily the flawed keys could be reproduced once their structure was known.