Repository navigation
RUSTSEC-2026-0383: Bundled root certificates allow trust in distrusted emSign intermediates #69
Description
Bundled root certificates allow trust in distrusted emSign intermediates
| Details | |
|---|---|
| Package | webpki-root-certs |
| Version | 1.0.9 |
| URL | rustls/webpki-roots#133 |
| Date | 2026-10-19 |
| Patched versions | >=1.0.10 |
| Unaffected versions | =0.26.11 |
Affected versions include emSign ECC Root CA - G3, which can allow certificate
paths through distrusted emSign intermediates.
Affected versions may accept certificate paths containing distrusted emSign
intermediate public keys. The private keys corresponding to these intermediates
are now well known.
Version 1.0.10+ removes this root.
Version 0.26.11 is a compatibility wrapper that re-exports
parent::TLS_SERVER_ROOT_CERTS from its webpki-root-certs 1.x dependency; it
contains no separate root certificate list. Its resolved 1.x dependency must be
updated to 1.0.10 or later.
See advisory page for additional details.
Activity
fix(deps): reject the distrusted emSign intermediates
fix(deps): reject the distrusted emSign intermediates (#71)