Affected versions include emSign ECC Root CA - G3, which can allow certificate
paths through distrusted emSign intermediates.
Affected versions may accept certificate paths containing distrusted emSign
intermediate public keys. The private keys corresponding to these intermediates
are now well known.
> Bundled root certificates allow trust in distrusted emSign intermediates
| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `webpki-root-certs` |
| Version | `1.0.9` |
| URL | [https://github.com/rustls/webpki-roots/pull/133](https://github.com/rustls/webpki-roots/pull/133) |
| Date | 2026-10-19 |
| Patched versions | `>=1.0.10` |
Affected versions include `emSign ECC Root CA - G3`, which can allow certificate
paths through distrusted emSign intermediates.
Affected versions may accept certificate paths containing distrusted emSign
intermediate public keys. The private keys corresponding to these intermediates
are now well known.
Version 1.0.10+ removes this root.
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0383.html) for additional details.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
webpki-root-certs1.0.9>=1.0.10Affected versions include
emSign ECC Root CA - G3, which can allow certificatepaths through distrusted emSign intermediates.
Affected versions may accept certificate paths containing distrusted emSign
intermediate public keys. The private keys corresponding to these intermediates
are now well known.
Version 1.0.10+ removes this root.
See advisory page for additional details.