Asset search can help teams find Go-related services, but CVE-2026-111943 is a toolchain and certificate-verification issue. A ZoomEye result does not reveal which compiler built an application or whether it calls the vulnerable trust path. The measurement needs to be used as a discovery aid, not as a vulnerability verdict.
The affected standard library is Go crypto/x509 before go1.26.10 and from go1.27.0-0 before go1.27.3. Go published fixes in go1.26.10 and go1.27.3. Mozilla reported that eight eMudhra intermediate certificate private keys were compromised. A chain containing one of those intermediates could be accepted by an affected Go verifier, enabling certificate impersonation when an attacker can intercept traffic.
The verified observation
The selected Search query was app="Go". ZoomEye returned 260,278 successful matches at the recorded time and the result passed the Exposure threshold used by this generation task. A second candidate, product="Go", returned the same count. These are query observations, not a census of vulnerable Go binaries.
The Filter query vul.cve="CVE-2026-111943" returned 0 and succeeded. That result does not cancel the Search observation. The selected Exposure rule takes the larger verified count. More importantly, neither count identifies the software version hidden inside an HTTP service.
The canonical search is available through the exact dork in the query record. The public link represents the selected search, not a claim that every result should be treated as compromised.
Why the count is broad
An app fingerprint can represent a server or framework associated with Go. It may reflect a product built with Go even if the exposed component never validates a certificate. It may also miss a Go binary behind a reverse proxy that emits another server fingerprint.
The match count can change as ZoomEye updates its index. It should be saved with the exact dork, timestamp, and scope used for the analysis. Treating a later or differently scoped count as the same observation makes trend comparisons unreliable.
Most importantly, the query cannot tell whether a system contains the patched crypto/x509 denylist. That information comes from build provenance, binary metadata, release packages, and controlled verification tests. A web service can match Go while its TLS is terminated by a non-Go proxy or its certificate validation is implemented outside the standard library.
Turning matches into an investigation
Use the ZoomEye result to find owners and external service boundaries. For each candidate, identify the host, organization, application, deployment path, and responsible team. Then correlate that asset with internal SBOM, image, package, and build records.
An owner can prove a positive build version from signed release metadata. It can also run a controlled test against a certificate chain that includes a blocked intermediate. If neither form of evidence exists, mark the asset as unknown rather than safe. Assign a rebuild task when the binary is reachable or security-critical.
External asset matches require care. A public service may be a front end for a product whose backend has different code. The same hostname may be shared by several applications. Validate the service response and ownership before opening a vulnerability ticket. Do not test certificate interception against third-party systems.
Exposure is not exploitation
The absence of a CVE-indexed filter result is not evidence that no affected system exists. ZoomEye's CVE field depends on its own indexing and banner evidence. The affected condition can sit entirely inside an application and never appear in an exposed banner.
Conversely, a large product-fingerprint count does not mean that an attacker has compromised those assets. The reviewed sources do not report exploitation of CVE-2026-111943 in the wild. The count is an estimate of the population that may deserve a review, while the vulnerability is a defect in a certificate-verification library.
What to record
Save the exact Search and Filter dorks, their successful status, counts, scope, and query times. State which query produced the Exposure value and why it was selected. Keep the asset classification separate from the CVE status.
The useful conclusion is narrow: ZoomEye found 260,278 assets matching app="Go" at the recorded time, and the CVE filter found 0. Those figures support prioritization and further ownership discovery. They do not prove vulnerable builds, active interception, forged certificates, or a compromise.