Key points
- Go versions 1.27.3 and 1.26.10 include one security fix.
- The fix involves CA certificate removal in the crypto/x509 package.
- The releases follow the official Go security policy.
Google released Go 1.27.3 and Go 1.26.10 on October 20, 2026. These minor point releases include a single security fix. The update pertains to CA certificate removal within the crypto/x509 package. This release follows the standard Go security policy for handling such updates.
In plain English
The Go programming language manages trusted certificates through its crypto/x509 package. These new versions update that package to remove a CA certificate. This change affects how Go validates secure connections. Developers using these Go versions will see this change after updating their toolchains.
The background
The announcement was posted to the oss-security mailing list by Alan Coopersmith. It references the official Go security policy regarding minor point releases. The advisory specifies that the fix pertains to the crypto/x509 package. No further details about the specific certificate were included in the brief advisory text.
What changes now
Users running Go 1.27 or 1.26 can update to versions 1.27.3 and 1.26.10. This change addresses the identified security fix. Applications compiled with older versions will continue to use the previous certificate store until they are recompiled with the updated Go toolchain. The update process is a standard version bump for these minor releases.
Who needs to act first
Teams should prioritize updating production environments that expose services to the public internet. Check whether your build pipelines automatically pull the latest Go version or if they pin specific releases. If you cannot update immediately, verify that your application does not rely on the removed certificate for critical connections. Test the updated Go version in a staging environment before rolling it out to production servers to ensure compatibility with existing dependencies.
What to do and how to stay safe: Go
- Review your current Go version across all development and production servers.
- Update your Go toolchain to 1.27.3 or 1.26.10 as soon as possible.
- Recompile any applications that use TLS connections to ensure they use the new certificate store.
- Monitor logs for any connection errors that might arise from the removed certificate.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Go versions are affected by this update?
Go 1.27 and Go 1.26 are affected, with fixes provided in versions 1.27.3 and 1.26.10.
Is there a CVE ID for this issue?
The source material does not mention a specific CVE ID for this certificate removal.
What package was modified to fix this issue?
The crypto/x509 package was updated to address the CA certificate removal.
