Reported

October 19, 2026

Issued

October 20, 2026 (last modified: October 21, 2026)

Package

webpki-roots (crates.io)

Type

Vulnerability

Categories

• crypto-failure

Keywords

#certificate #distrust #x509

Aliases

• CVE-2026-111943

References

• https://github.com/rustls/webpki-roots/pull/133
• https://emudhra.we-have-a-problem.com/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

Patched

• >=1.0.10

Unaffected

• =0.26.11

Description

Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates.

Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well known.

Version 1.0.10+ removes this root.

The webpki-roots 0.26.11 compatibility package contains no independent trust store and re-exports the roots from its separately resolved 1.x dependency. That parent dependency must resolve to 1.0.10 or newer; an older parent remains affected by this advisory.

Advisory available under CC0-1.0 license.