Certifi bundles emSign root CAs with compromised intermediate keys
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-295.
Summary
Certifi versions from 2019.03.09 before 2026.10.18 bundle the emSign ECC Root CA - G3 root certificate, which chains to eight eMudhra intermediate CA certificates whose private keys are compromised and revoked. An attacker holding one of these keys can issue valid-looking certificates for any hostname (CWE-295). An on-path attacker can then intercept or modify TLS traffic from clients that trust the bundle, such as requests, urllib3 and pip.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the GitHub advisory
Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer. Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | certifi (PyPI) | 2019.03.09 to before 2026.10.18 | 2026.10.18 | Patch available | GHSA-6q48-6c7w-9gw2 |
- certifi (PyPI) Vendor— Affected 2019.03.09 to before 2026.10.18 Fixed in 2026.10.18 Patch available GHSA-6q48-6c7w-9gw2
Remediation
Certifi 2026.10.18 is the fixed version that removes all emSign roots, and 2026.10.19 restores the unaffected ones. Upgrade to 2026.10.19 or later and rebuild container images that vendor certifi.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · GHSA-6q48-6c7w-9gw2 certifi (PyPI) Fixed in 2026.10.18 Advisory →
Timeline
- 2026-10-21 Threatist record created from GHSA-6q48-6c7w-9gw2
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences