---
title: Tip: a Go TLS fix only protects binaries you rebuild, so inventory Go builds with 'go version -m' and redeploy the ones older than 1.27.3 / 1.26.10 | ctxsec
url: https://ctxsec.com/items/tip-go-rebuild-find-stale-binaries
description: ""
status: "tip (based on the Go CVE-2026-111943 release + Go docs)"
published: 2026-10-20
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-go-rebuild-find-stale-binaries.md)

tip (based on the Go CVE-2026-111943 release + Go docs)

2026-10-20

### Tip: a Go TLS fix only protects binaries you rebuild, so inventory Go builds with 'go version -m' and redeploy the ones older than 1.27.3 / 1.26.10

Go statically links its standard library, so the new block on eight revoked eMudhra intermediates ([CVE-2026-111943](/news#go-cve-2026-111943-emudhra-intermediates-distrust)) only takes effect in programs **compiled** with Go 1.27.3 or 1.26.10. Upgrading the Go toolchain on a server does nothing for binaries already running there.

1. **Find Go binaries and their toolchain:** `go version -m /path/to/binary` prints the Go version a binary was built with (the first line) plus its module list. Run it across container images, `/usr/local/bin`, CI artifacts and agents (Terraform providers, kubectl plugins, exporters, sidecars, CLIs like gh and many security tools are Go).
2. **Rebuild what you own** on 1.27.3/1.26.10 and redeploy. In Dockerfiles, pin the patch version (`golang:1.27.3`), not just `1.27`, so a cached base image isn't reused.
3. **Third-party Go tools:** watch for vendor releases built on the new toolchain. Until then, those tools still trust the revoked chains.
4. **Test for breakage:** before rollout, connect rebuilt clients to your partner and API endpoints. An `x509: no valid chains built` error means that endpoint chains through one of the blocked intermediates and needs a new certificate.
5. **Make it routine:** Go ships minor security releases roughly monthly. Set a recurring rebuild-and-redeploy for Go services so fixes like this aren't left sitting in old binaries.

Sources: [Go issue #82345](https://github.com/golang/go/issues/82345) · [Go command docs: go version -m](https://pkg.go.dev/cmd/go#hdr-Print_Go_version) · [Go security policy (URGENT track)](https://go.dev/doc/security/policy)