PYSEC-2026-4321 uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An...

GHSA-HQ85-5CPJ-MR62 uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An...

uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An...

Fedora 44 : python-uv-build / rust-ambient-id / rust-astral-reqwest-middleware / etc (2026-b8b59dcf44)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-b8b59dcf44 advisory. Update uv and python-uv-build to 0.11.2. Version 0.11 includes changes to the networking stack used by uv. While its developers think that breakage will be...