geth 1.17.9 shipped two days after Go's urgent crypto/x509 fix. Whether your node has it depends on how you installed it. The Docker image was built with go1.27.3 and has the new distrust list. The linux-amd64 tarball from the same commit was built with go1.27.2 and doesn't. The tarball build fetches whatever Go version build/checksums.txt pins. That pin moved to 1.27.3 the morning after the release. What I can't settle is how much it matters on a running node. The fix only bites where geth checks a public CA chain, and the two places I've found are download-era and a blsync --beacon.api endpoint. If there's a third path I haven't found, it changes how urgent this is for anyone on the tarball.