CPANSA-Mozilla-CA-2026-113812: Mozilla-CA vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-10-20T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-10-20T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | Severity | ||
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates.
The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available.
An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server.
LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA.
Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.
Vulnerabilities
CVE-2026-113812
Vulnerability DescriptionMozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates.
The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available.
An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server.
LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA.
Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.
| Weakness | CWE-295 : Improper Certificate Validation |
|---|
Product status
Known affected
| Product | Score | ||||
|---|---|---|---|---|---|
| Mozilla-CA less than 20261020 |
|
Fixed
- Mozilla-CA greater than or equal 20261020
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Mozilla-CA-2026-113812 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-mozilla-ca-2026-113812.json - https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 external
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 - https://emudhra.we-have-a-problem.com/ external
https://emudhra.we-have-a-problem.com/ - https://metacpan.org/release/LWP/Mozilla-CA-20261020/changes external
https://metacpan.org/release/LWP/Mozilla-CA-20261020/changes - https://www.openwall.com/lists/oss-security/2026/10/20/1 external
https://www.openwall.com/lists/oss-security/2026/10/20/1 - http://www.openwall.com/lists/oss-security/2026/10/20/36 external
http://www.openwall.com/lists/oss-security/2026/10/20/36 - CVE-2026-113812 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-113812
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Tue Oct 20 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/