{"type":"bundle","id":"bundle--ad54c71a-f794-597e-900c-3b2e89a511e7","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--86b9f6ed-575a-5330-9858-6304c722fc16","created":"2026-10-21T16:05:05.791Z","modified":"2026-10-21T16:05:05.791Z","name":"eMudhra CA keys leaked: forged HTTPS certificates still pass in unpatched Go, Python, Node.js and Java (CVE-2026-111943)","description":"eMudhra created eight intermediate CAs (EM DV, OV and EV TLS CA G3B and G3C, plus EM OV CS CA G3B and G3C) at an April 30, 2025 key ceremony with P-384 private keys below 256, so anyone can recover them from the public certificates. Sectigo cross-signed all eight under AAA Certificate Services. A researcher proved key control to the root programs on October 17, 2026. Chrome, Firefox, Apple and Microsoft blocked the intermediates through CRLSet, OneCRL and their own channels between October 17 and 20, eMudhra revoked them on October 18 and Sectigo revoked the cross-signs on October 19. Mozilla and Chrome are removing emSign ECC Root CA - G3. Clients outside the browser that skip revocation and Certificate Transparency, including Go, Python certifi, Node.js, Java cacerts, Linux ca-certificates and macOS /etc/ssl/cert.pem, accept forged certificates for any hostname until updated: Go 1.27.3/1.26.10 (CVE-2026-111943), certifi 2026.10.18+, Node.js 22.23.4/24.22.1/26.12.1, NSS 3.131.1 and distro ca-certificates updates.","aliases":["CVE-2026-111943","GO-2026-6809","GHSA-6q48-6c7w-9gw2","eMudhra intermediate CA compromise","emSign ECC Root CA - G3 distrust","EM DV TLS CA - G3B","Mozilla Bug 2083449","we have a problem eMudhra"],"first_seen":"2026-10-17T18:05:00Z","last_seen":"2026-10-21T15:59:56Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Mozilla Bug 2083449: eMudhra private key compromise of intermediate certificates","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2083449"},{"source_name":"Chrome and Android security teams: protecting users from compromised eMudhra intermediate CA certificates","url":"https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/"},{"source_name":"Mozilla Security Blog: protecting Firefox users following the compromise of eMudhra intermediate certificates","url":"https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/"},{"source_name":"Mozilla notice to trust store operators (oss-security)","url":"https://www.openwall.com/lists/oss-security/2026/10/20/1"},{"source_name":"Go issue 82345: crypto/x509 mitigation for a specific Certificate Authority","url":"https://go.dev/issue/82345"},{"source_name":"Go vulnerability GO-2026-6809 (CVE-2026-111943)","url":"https://pkg.go.dev/vuln/GO-2026-6809"},{"source_name":"Go 1.27.3 and Go 1.26.10 security release announcement","url":"https://www.openwall.com/lists/oss-security/2026/10/20/29"},{"source_name":"certifi GHSA-6q48-6c7w-9gw2: removal of emSign root certificate","url":"https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2"},{"source_name":"Node.js October 21, 2026 security releases","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"},{"source_name":"eMudhra statement on the certificate security incident","url":"https://emudhra.com/en/post/certificate-security-incident"},{"source_name":"eMudhra intermediate CA compromise disclosure tracker and client test hosts","url":"https://emudhra.we-have-a-problem.com/"},{"source_name":"BellSoft: distrusting compromised eMudhra intermediates in Java","url":"https://bell-sw.com/blog/distrusting-compromised-emudhra-intermediates-in-java/"},{"source_name":"HOL operator write-up: eMudhra CA keys leaked (CVE-2026-111943)","url":"https://hol.org/blog/cve-2026-111943-emudhra-ca-key-compromise-go-certifi-node-java"}]}]}