Go 1.27.3 ships unannounced for first urgent-track CVE

Go 1.27.3 is a legitimate security release, Go team member Damien Neil confirmed after developers noticed the build had appeared without the usual note on golang-announce.

Neil said the update fixes an urgent-track issue under the project's security policy, and that this is the first time Go has used that severity class. Urgent-track fixes are reserved for problems serious enough that the project ships before a full public announcement cycle.

According to the changelog, the release distrusts a set of intermediate certificates and addresses CVE-2026-111943. Further technical detail on the flaw has not been disclosed with the release. Users who obtain 1.27.3 through the normal Go download channels are receiving the intended fix.