Every CVE Search/ Get API key

CVE-2026-113812

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates

9.1 CriticalFix available

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates.

The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available.

An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server.

LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA.

Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.34%Up 0.2 points since Oct 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates.

The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available.

An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server.

LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA.

Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.

Record
CVE-2026-113812
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
EUVDEUVD-2026-105771 9.1

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates.

The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available.

An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server.

LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA.

Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.

Record
EUVD-2026-105771
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-h2xv-9jg2-5v55 9.1

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root...

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates.

The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available.

An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server.

LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA.

Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.

Record
GHSA-h2xv-9jg2-5v55
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
NVD 9.1

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates.

The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available.

An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server.

LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA.

Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.

Record
CVE-2026-113812
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVBELL-CVE-2026-113812 9.1
Record
BELL-CVE-2026-113812
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSV 9.1

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates.

The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available.

An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server.

LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA.

Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.

Record
CVE-2026-113812
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2026-113812 9.1

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available. An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server. LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA. Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.

Record
DEBIAN-CVE-2026-113812
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-113812 9.1

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available. An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server. LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA. Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.

Record
UBUNTU-CVE-2026-113812
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
OSVAZL-109872 No score

CVE-2026-113812 affecting package perl-Mozilla-CA 20240730-2

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates.

The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available.

An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server.

LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA.

Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.

Record
AZL-109872
Updated
2026-11-05
OSVMGASA-2026-0536 No score

Updated perl-Mozilla-CA package fixes a security vulnerability

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. (CVE-2026-113812)

Record
MGASA-2026-0536
Updated
2026-11-02
OSVopenSUSE-SU-2026:12250-1 No score

perl-Mozilla-CA-20261020.0.0-1.1 on GA media

These are all security issues fixed in the perl-Mozilla-CA-20261020.0.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12250-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22207-1 No score

Security update for perl-Mozilla-CA

This update for perl-Mozilla-CA fixes the following issues:

Changes in perl-Mozilla-CA:

  • updated to 20261020.0.0 (20261020)

    • 20261020

      • Update from Mozilla repository to 2026-10-20
      • Denylisted certificates: CVE-2026-113812 bsc#1287179
        • emSign ECC Root CA - G3 sha256: 86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b

    • 20260813

      • Update from Mozilla repository to 2026-08-13
      • Added certificates:
        • OISTE Server Root ECC G1 sha256: eec997c0c30f216f7e3b8b307d2bae42412d753fc8219dafd1520b2572850f49
        • OISTE Server Root RSA G1 sha256: 9ae36232a5189ffddb353dfd26520c015395d22777dac59db57b98c089a651e6
        • SECOM TLS ECC Root CA 2024 sha256: 6ab2ab75f51cb4f4f0156203fbf6f646232f514be059f62833308b82b4d72db1
        • SECOM TLS RSA Root CA 2024 sha256: 1435f225c5d252d7a21948cc3ce62aecfa88001e3dd72d1cc3555100eb372f93
        • SwissSign RSA TLS Root CA 2022 - 1 sha256: 193144f431e0fddb740717d4de926a571133884b4360d30e272913cbe660ce41
        • Telia EC TLS Root CA v3 sha256: 098e08a91dbbf77478b96cceb89b1413a5da37b7c862606a955deb07179f4326
        • Telia RSA TLS Root CA v3 sha256: d13db1294c45ebc6fc86c6bbf69fa29bdfe692dff7c713c243c7a956c6a2284c
        • TrustAsia TLS ECC Root CA sha256: c0076b9ef0531fb1a656d67c4ebe97cd5dbaa41ef44598acc2489878c92d8711
        • TrustAsia TLS RSA Root CA sha256: 06c08d7dafd876971eb1124fe67f847ec0c7a158d3ea53cbe940e2ea9791f4c3
        • e-Szigno TLS Root CA 2023 sha256: b49141502d00663d740f2e7ec340c52800962666121a36d09cf7dd2b90384fb4
      • Removed certificates:
        • AffirmTrust Commercial sha256: 0376ab1d54c5f9803ce4b2e201a0ee7eef7b57b636e8a93c9b8d4860c96f5fa7
        • AffirmTrust Networking sha256: 0a81ec5a929777f145904af38d5d509f66b5e2c58fcdb531058b0e17f3f0b41b
        • AffirmTrust Premium sha256: 70a73f7f376b60074248904534b11482d5bf0e698ecc498df52577ebf2e93b9a
        • AffirmTrust Premium ECC sha256: bd71fdf6da97e4cf62d1647add2581b07d79adf8397eb4ecba9c5e8488821423
        • Atos TrustedRoot 2011 sha256: f356bea244b7a91eb35d53ca9ad7864ace018e2d35d5f8f96ddf68a6f41aa474
        • COMODO Certification Authority sha256: 0c2cd63df7806fa399ede809116b575bf87989f06518f9808c860503178baf66
        • Certigna sha256: e3b6a2db2ed7ce48842f7ac53241c7b71d54144bfb40c11f3f1d0b42f5eea12d
        • CommScope Public Trust ECC Root-01 sha256: 11437cda7bb45e41365f45b39a38986b0de00def348e0c7bb0873633800bc38b
        • CommScope Public Trust ECC Root-02 sha256: 2ffb7f813bbbb3c89ab4e8162d0f16d71509a830cc9d73c262e5140875d1ad4a
        • CommScope Public Trust RSA Root-01 sha256: 02bdf96e2a45dd9bf18fc7e1dbdf21a0379ba3c9c2610344cfd8d606fec1ed81
        • CommScope Public Trust RSA Root-02 sha256: ffe943d793424b4f7c440c1c3d648d5363f34b82dc87aa7a9f118fc5dee101f1
        • DigiCert Assured ID Root CA sha256: 3e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c
        • DigiCert Global Root CA sha256: 4348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c70161
        • DigiCert High Assurance EV Root CA sha256: 7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf
        • Entrust Root Certification Authority sha256: 73c176434f1bc6d5adf45b0e76e727287c8de57616c1e6e6141a2b2cbc7d8e4c
        • Entrust Root Certification Authority - EC1 sha256: 02ed0eb28c14da45165c566791700d6451d7fb56f0b2ab1d3b8eb070e56edff5
        • Entrust Root Certification Authority - G2 sha256: 43df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f339
        • FIRMAPROFESIONAL CA ROOT-A WEB sha256: bef256daf26e9c69bdec1602359798f3caf71821a03e018257c53c65617f3d4a
        • GLOBALTRUST 2020 sha256: 9a296a5182d1d451a2e37f439b74daafa267523329f90f9a0d2007c334e23c9a
        • GTS Root R2 sha256: 8d25cd97229dbf70356bda4eb3cc734031e24cf00fafcfd32dc76eb5841c7ea8
        • QuoVadis…
Record
openSUSE-SU-2026:22207-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
perl-Mozilla-CA
Azure Linux:3
 through 20240730-2 None known
perl-mozilla-ca
Alpaquita:23
 20221114-r0 up to 20261020-r0
20261020-r0
perl-mozilla-ca
Alpaquita:25
 20250202-r0 up to 20261020-r0
20261020-r0
perl-mozilla-ca
Alpaquita:stream
 20221114-r2 up to 20261020-r0
20261020-r0
libmozilla-ca-perl
Debian:13
 All versions, plus listed versions
20250202-120260813-1
 None known
libmozilla-ca-perl
Debian:14
 All versions, plus listed versions
20250202-120260813-1
 None known
perl-Mozilla-CA
Mageia:10
 before 20261020.0.0-2.mga10
20261020.0.0-2.mga10
libmozilla-ca-perl
Ubuntu:24.04:LTS
 All versions, plus listed versions
20230821-120230821-2
 None known
libmozilla-ca-perl
Ubuntu:26.10
 All versions, plus listed versions
20250202-1
 None known
libmozilla-ca-perl
Ubuntu:26.04:LTS
 All versions, plus listed versions
20250202-1
 None known
perl-Mozilla-CA
openSUSE:Tumbleweed
 before 20261020.0.0-1.1
20261020.0.0-1.1
perl-Mozilla-CA
openSUSE:Leap 16.0
 before 20261020.0.0-bp160.1.1
20261020.0.0-bp160.1.1

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-113812 is a critical vulnerability (CVSS 9.1) in perl-Mozilla-CA, published October 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in perl-mozilla-ca 20261020-r0.

References

Show 13 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open