RUSTSEC-2026-0381

    Dashboard / Vulnerabilities / RUSTSEC-2026-0381

    RUSTSEC-2026-0381

    Published: 19 Oct 2026Last Modified: 29 Oct 2026

    Summary: Bundled root certificates allow trust in distrusted emSign intermediates

    Details: Affected versions include `emSign ECC Root CA - G3`, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well known. Version 1.0.10+ removes this root. The `webpki-roots` 0.26.11 compatibility package contains no independent trust store and re-exports the roots from its separately resolved 1.x dependency. That parent dependency must resolve to 1.0.10 or newer; an older parent remains affected by this advisory.

    References: https://crates.io/crates/webpki-roots, https://rustsec.org/advisories/RUSTSEC-2026-0381.html, https://github.com/rustls/webpki-roots/pull/133, https://emudhra.we-have-a-problem.com/, https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

    Affected packages

    Package

    Name: webpki-roots

    Purl: pkg:cargo/webpki-roots

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.0.0-0
    Fixed -0.26.11

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High