Go will reject certificate chains containing eight distrusted SPKIs

Go will reject certificate chains containing eight distrusted intermediate certificates due to specific security concerns with their operation (CVE-2026-111943). The crypto/x509 package's Verify function will filter out chains containing these intermediates to prevent them from being returned to callers. The Go team recommends immediate upgrading to the patched releases across Go 1.26, 1.27, and 1.28.