The eMudhra fix lives in your Go binary, not in your Docker image
go
dev.to
On October 19, Go shipped two security releases: 1.27.3 and 1.26.10. The fix touches a single package, crypto/x509. I rebuilt one of my Go services on the same Docker image as before. Go's own scanner still found the flaw. TL;DR: the eMudhra fix is a list of eight banned keys, written into the code of crypto/x509. That list is compiled into your binary. Updating the base image or the system certificates does not add it. You have to rebuild with Go 1.27.3 or 1.26.10, then redeploy. If your Dock