Repository navigation
RUSTSEC-2026-0381: Bundled root certificates allow trust in distrusted emSign intermediates #50
Description
Bundled root certificates allow trust in distrusted emSign intermediates
| Details | |
|---|---|
| Package | webpki-roots |
| Version | 1.0.9 |
| URL | rustls/webpki-roots#133 |
| Date | 2026-10-19 |
| Patched versions | >=1.0.10 |
| Unaffected versions | =0.26.11 |
Affected versions include emSign ECC Root CA - G3, which can allow certificate
paths through distrusted emSign intermediates.
Affected versions may accept certificate paths containing distrusted emSign
intermediate public keys. The private keys corresponding to these intermediates
are now well known.
Version 1.0.10+ removes this root.
The webpki-roots 0.26.11 compatibility package contains no independent trust
store and re-exports the roots from its separately resolved 1.x dependency.
That parent dependency must resolve to 1.0.10 or newer; an older parent remains
affected by this advisory.
See advisory page for additional details.
Activity