PT-2026-120303

Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue...

WS-2026-0133

certifi 2019.03.09 through 2026.07.22 ships the "emSign ECC Root CA - G3" root certificate in its CA bundle certifi/cacert.pem. Intermediates under this root were revoked for key compromise cACompromise, so certificates issued with the compromised CA keys are trusted by applications that use...

PT-2026-120337

Affected versions may accept certificate paths containing distrusted emSign intermediate public keys when the configured trust anchors allow such paths. The private keys corresponding to these intermediates are now well known. Versions 0.103.16 and 0.104.0-alpha.8 reject paths containing these...

Bundled root certificates allow trust in distrusted emSign intermediates

Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well...

RUSTSEC-2026-0381 Bundled root certificates allow trust in distrusted emSign intermediates

Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well...

RUSTSEC-2026-0383 Bundled root certificates allow trust in distrusted emSign intermediates

Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well...

Bundled root certificates allow trust in distrusted emSign intermediates

Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well...

WS-2026-0175

webpki-roots 0.17.0 through 1.0.9 except 0.26.11 and webpki-root-certs before 1.0.10 except 0.26.11 ship the "emSign ECC Root CA - G3" root, and rustls-webpki before 0.103.16 and 0.104.0-alpha.8 does not reject certificate paths containing the distrusted eMudhra emSign intermediate public keys. T...

PT-2026-120336

Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well...

PT-2026-120338

Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well...