GHSA-6q48-6c7w-9gw2
certifi bundles emSign root CAs with compromised intermediate CA keys
Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them.
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v4.0)
- Affected packages
- certifi (pip) >= 2019.03.09, < 2026.10.19, fixed in 2026.10.19 · GHSA-6q48-6c7w-9gw2