Security Operations
Threat Intelligence
๐Ÿ”Ž
โ“

GHSA-hq85-5cpj-mr62 - uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks. uv 0.13.4 removes the root from its vendored bundle, following `webpki-root-certs` 1.0.10. Upgrade to 0.13.4 or later.
CRITICAL
Severity & confidence
Source severitycritical
Platform severitycritical
Confidencemedium
Exploitationunknown
CVSS-
Affected
Vendorsuv
Productsuv
Reporting sources (1)
GitHub Security Advisories
Open source โ†—
Timeline & provenance
Published2026-10-20T19:37:52
Last updated2026-10-21T05:51:56
Ingested2026-10-20T19:43:55
FreshnessNEAR-REAL-TIME
Threat typeadvisory
Recommended action
Review the advisory and upgrade affected packages to the first patched version.
Next steps
  1. Identify affected systems in your environment.
  2. Apply the vendor patch or mitigation guidance.
  3. Review logs for indicators described in the advisory.
  4. Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a single or secondary source; treat as indicative, verify before acting.
Source type: vendor ยท Original: GitHub Security Advisories