{"id":"RUSTSEC-2026-0381","revision":"89230e95cbd8419eb3a80aa135480285","records":[{"revision":"89230e95cbd8419eb3a80aa135480285","observedAt":"2026-10-29T11:13:03.134+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0381","aliases":["BIT-golang-2026-111943","CVE-2026-111943","GO-2026-6809","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"title":"Bundled root certificates allow trust in distrusted emSign intermediates","description":"Affected versions include `emSign ECC Root CA - G3`, which can allow certificate\npaths through distrusted emSign intermediates.\n\nAffected versions may accept certificate paths containing distrusted emSign\nintermediate public keys. The private keys corresponding to these intermediates\nare now well known.\n\nVersion 1.0.10+ removes this root.\n\nThe `webpki-roots` 0.26.11 compatibility package contains no independent trust\nstore and re-exports the roots from its separately resolved 1.x dependency.\nThat parent dependency must resolve to 1.0.10 or newer; an older parent remains\naffected by this advisory.","state":0,"publishedAt":"2026-10-19T12:00:00+00:00","modifiedAt":"2026-10-29T10:55:54.0963943+00:00","affected":[{"ecosystem":"crates.io","name":"webpki-roots","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.26.11"},{"kind":"introduced","version":"0.26.12-0"},{"kind":"fixed","version":"1.0.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/webpki-roots","https://rustsec.org/advisories/RUSTSEC-2026-0381.html","https://github.com/rustls/webpki-roots/pull/133","https://emudhra.we-have-a-problem.com/","https://bugzilla.mozilla.org/show_bug.cgi?id=2083449"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0381","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0381","identifiers":["RUSTSEC-2026-0381","BIT-golang-2026-111943","CVE-2026-111943","GO-2026-6809","RUSTSEC-2026-0382","RUSTSEC-2026-0383"]},"retained":false,"historicalAffected":[]}],"coverage":[]}