29.9.2
For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
Security
The Go runtime update addresses CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates. Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates. Affected registries need a replacement certificate chain that does not use these intermediates.
The blocked intermediates are:
- Domain-validated TLS:
EM DV TLS CA - G3BandEM DV TLS CA - G3C - Organization-validated TLS:
EM OV TLS CA - G3BandEM OV TLS CA - G3C - Extended-validation TLS:
EM EV TLS CA - G3BandEM EV TLS CA - G3C - Code signing:
EM OV CS CA - G3BandEM OV CS CA - G3C
The G3B intermediates belong to eMudhra BV, and the G3C intermediates belong to eMudhra Inc. The keys for these intermediates were compromised.
Packaging updates
- Update Go runtime to 1.26.10. moby/moby#53989, docker/cli#7418