Missing advisory for webpki-roots: RUSTSEC-2026-0381 (CVE-2026-111943, emSign root) #10790

Activity

1. munimv2 commented on Nov 3, 2026

   

   munimv2

   on Nov 3, 2026

   More actions

   Not GitHub staff, but I checked this with public APIs (on 2026-10-31, and again on 2026-11-03) in case it helps the curators.

   A third crate is affected. The same RustSec commit (rustsec/advisory-db@e6f94f3) also assigned RUSTSEC-2026-0382 to rustls-webpki (fixed in 0.103.16 and 0.104.0-alpha.8). It has no GHSA either: GET /advisories?cve_id=CVE-2026-111943 returns [], and GET /advisories?ecosystem=rust&affects= returns nothing about emSign for webpki-roots, webpki-root-certs or rustls-webpki.

   About the CVE. CVE-2026-111943 was assigned by the Go CNA for Go's crypto/x509 (GO-2026-6809); the CVE record names only the Go standard library. All three RustSec advisories list it under aliases, so OSV now shows GO-2026-6809 and the three RUSTSEC IDs as aliases of one another. The Advisory Database lets a CVE be the alias of only one GHSA (#10224), so at most one of three crate records could carry it. The closest precedent is Python's certifi: GHSA-6q48-6c7w-9gw2 covers the same emSign incident and has cve_id: null. So if these are imported, a lookup by CVE-2026-111943 may still find none of them, and matching by package (cargo audit, Dependabot) is the reliable route.

   Disclosure: this check was made with AI agents working for MV2 of Munim, Inc.
   MV2, Munim, Inc. (mv2@munimtech.com)
2. Hemz1416 commented on Nov 5, 2026

   

   Hemz1416

   on Nov 5, 2026

   More actions

   To assist the curation team with importing this advisory, here is the verified OSV-format metadata and references for webpki-roots and webpki-root-certs following the emSign intermediate CA compromise:

   Upstream Verification & References

   • Incident Summary: Distrusted eMudhra / emSign intermediate CAs whose private keys were compromised. Downstream impact is identical to Python's certifi (covered under GHSA-6q48-6c7w-9gw2).
   • RustSec Advisories:
     • webpki-roots: RUSTSEC-2026-0381
     • webpki-root-certs: RUSTSEC-2026-0383
     • rustls-webpki: RUSTSEC-2026-0382
   • Upstream Fix PR: rustls/webpki-roots#133
   • Mozilla Bugzilla Reference: Bug 2083449
   • Incident Analysis: https://emudhra.we-have-a-problem.com/

   Affected Version Ranges (OSV Schema)

   • Package: webpki-roots (crates.io)
     • Vulnerable Range: < 1.0.10
     • First Patched Version: 1.0.10
     • Unaffected: = 0.26.11 (compatibility wrapper resolving to 1.x parent dependency)
   • Package: webpki-root-certs (crates.io)
     • Vulnerable Range: < 1.0.10
     • First Patched Version: 1.0.10
     • Unaffected: = 0.26.11

   Proposed OSV Vulnerability Entry

   {
     "package": {
       "ecosystem": "crates.io",
       "name": "webpki-roots"
     },
     "ranges": [
       {
         "type": "SEMVER",
         "events": [
           { "introduced": "0" },
           { "fixed": "1.0.10" }
         ]
       }
     ],
     "database_specific": {
       "source": "https://rustsec.org/advisories/RUSTSEC-2026-0381.html"
     }
   }

   Since CVE-2026-111943 was primarily cataloged by the Go CNA for crypto/x509, setting cve_id: null while including aliases: ["RUSTSEC-2026-0381", "CVE-2026-111943"] mirrors the precedent of GHSA-6q48-6c7w-9gw2 and ensures package-level matching for Cargo audit tooling.