GHSA-6q48-6c7w-9gw2

Critical

Published: —Translated: 28/10/2026(UTC)NVD NIST

Summary

Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates chaining to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue certificates.

Risk Assessment

An attacker with a compromised intermediate key can issue fraudulent certificates trusted by applications using Certifi, enabling server impersonation and man-in-the-middle attacks. The risk affects Python applications relying on this trust store.

Recommendation

Upgrade the Certifi package to version 2026.10.18 or later to remove the compromised certificates from the trust store.

Other vulnerabilities in Certifi

CVE-2023-37920High
Certifi, a collection of root certificates for SSL verification, prior to version 2023.07.22 recognized 'e-Tugra' root certificates. Following reports of security issues in 'e-Tugra' systems, these certificates were removed from the root store in version 2023.07.22.

Original NVD description (English source)

Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue

Vulnerability data from NVD (NIST) · CISA KEV · EPSS