Description
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — | — |
| Red Hat | Red Hat OpenStack Platform 13.0 - ELS | — | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 | — | — |
| Red Hat | Red Hat OpenStack Services on OpenShift 18.0 | — | — |
| Red Hat | Service Interconnect 2 for RHEL 9 | — | — |
| Red Hat | agentic cluster security suite 0.2 | — | — |
| Red Hat | Cost Management 4 | — | — |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.11 | — | — |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 | — | — |
| Red Hat | Red Hat AI Inference Server 3.2 | — | — |
| Red Hat | Red Hat AI Inference Server 3.4 | — | — |
| Red Hat | Red Hat AI Inference Server 3.5 | — | — |
| Red Hat | Red Hat Cost Management On-Premise 1 | — | — |
| Red Hat | Red Hat Developer Hub 1.10 | — | — |
| Red Hat | Red Hat Developer Hub 2.1 | — | — |
| Red Hat | Red Hat Discovery 2 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.5 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift AI 3.0 | — | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — | — |
| Red Hat | Red Hat OpenShift AI 3.5 | — | — |
| Red Hat | Red Hat OpenShift Builds 1.8.3 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | ca-certificates | 2026.2.92_v9.0.319-100.3.el10_2 | RHSA-2026:88455 |
| RHEL 9 | ca-certificates | 2026.2.92_v9.0.319-90.3.el9_8 | RHSA-2026:88459 |
| RHEL 8 | ca-certificates | 2026.2.92_v9.0.319-81.3.el8_10 | RHSA-2026:88550 |
Show 16 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | ca-certificates | 2026.2.92_v9.0.319-100.3.el10_0 | RHSA-2026:88560 |
| RHEL 9.6 EUS | ca-certificates | 2026.2.92_v9.0.319-90.3.el9_6 | RHSA-2026:88563 |
| RHEL 9.4 E4S | ca-certificates | 2026.2.92_v9.0.319-90.3.el9_4 | RHSA-2026:88564 |
| RHEL 9.2 E4S | ca-certificates | 2026.2.92_v9.0.319-90.3.el9_2 | RHSA-2026:88562 |
| RHEL 8.8 TUS | ca-certificates | 2026.2.92_v9.0.319-80.3.el8_8 | RHSA-2026:88662 |
| RHEL 8.8 E4S | ca-certificates | 2026.2.92_v9.0.319-80.3.el8_8 | RHSA-2026:88662 |
| RHEL 8.6 EUS Long Life | ca-certificates | 2026.2.92_v9.0.319-80.3.el8_6 | RHSA-2026:88668 |
| RHEL 8.6 AUS | ca-certificates | 2026.2.92_v9.0.319-80.3.el8_6 | RHSA-2026:88668 |
| RHEL 8.4 AUS | ca-certificates | 2026.2.92_v9.0.319-80.3.el8_4 | RHSA-2026:88669 |
| RHEL 7 ELS | ca-certificates | 2026.2.92_v9.0.319-70.3.el7_9 | RHSA-2026:88779 |
| RHEL 6 ELS | ca-certificates | 2026.2.92_v9.0.319-60.3.el6_10 | RHSA-2026:90985 |
| RHEL 6 ELS | nss +4 | 3.44.0-15.el6_10 | RHSA-2026:90985 |
| Red Hat OpenStack 18 | python-botocore +1 | 1.27.89-3.el9ost | RHSA-2026:93046 |
| Red Hat OpenStack 17 | python-botocore +1 | 1.20.68-2.el9ost | RHSA-2026:93045 |
| Red Hat OpenStack 16 | python-botocore +1 | 1.12.119-4.el8ost | RHSA-2026:93044 |
| Red Hat OpenStack 13 | python-botocore +1 | 1.8.33-2.el7ost | RHSA-2026:93043 |
| Red Hat Hardened Images 1 | ca-certificates +1 | 2026.2.92_v9.0.319-1.hum1 | RHSA-2026:86595 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | ca-certificates | 2026.2.92_v9.0.319-100.3.el10_2 | ALSA-2026:88455 |
| AlmaLinux 9 | ca-certificates | 2026.2.92_v9.0.319-90.3.el9_8 | ALSA-2026:88459 |
| AlmaLinux 8 | ca-certificates | 2026.2.92_v9.0.319-81.3.el8_10 | ALSA-2026:88550 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ca-certificates | 2026.2.92_v9.0.319-100.3.el10_2 | RLSA-2026:88455 |
| Rocky Linux 9 | ca-certificates | 2026.2.92_v9.0.319-90.3.el9_8 | RLSA-2026:88459 |
| Rocky Linux 8 | ca-certificates | 2026.2.92_v9.0.319-81.3.el8_10 | RLSA-2026:88550 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | ca-certificates-mozilla | 2.92-150200.50.2 | SUSE-SU-2026:4847-1 |
| SLES 15 SP7 | ca-certificates-mozilla-prebuilt | 2.92-150200.50.3 | SUSE-SU-2026:4847-1 |
| SLES 15 SP6 | ca-certificates-mozilla | 2.92-150200.50.2 | SUSE-SU-2026:4847-1 |
| SLES 15 SP6 | ca-certificates-mozilla-prebuilt | 2.92-150200.50.3 | SUSE-SU-2026:4847-1 |
| SLES 15 SP5 | ca-certificates-mozilla | 2.92-150200.50.2 | SUSE-SU-2026:4847-1 |
| SLES 15 SP5 | ca-certificates-mozilla-prebuilt | 2.92-150200.50.3 | SUSE-SU-2026:4847-1 |
| SLES 15 SP4 | ca-certificates-mozilla | 2.92-150200.50.2 | SUSE-SU-2026:4847-1 |
| SLES 15 SP4 | ca-certificates-mozilla-prebuilt | 2.92-150200.50.3 | SUSE-SU-2026:4847-1 |
| SLES 11 SP4 | openssl-certs | 2.92-0.7.39.1 | SUSE-SU-2026:4820-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | ca-certificates-mozilla | 2.92-160000.1.1 | SUSE-SU-2026:24361-1 |
| SLES for SAP 16.0 | ca-certificates-mozilla-prebuilt | 2.92-160000.1.4 | SUSE-SU-2026:24361-1 |
| SLES for SAP 15 SP6 | ca-certificates-mozilla | 2.92-150200.50.2 | SUSE-SU-2026:4847-1 |
| SLES for SAP 15 SP6 | ca-certificates-mozilla-prebuilt | 2.92-150200.50.3 | SUSE-SU-2026:4847-1 |
| SLES for SAP 15 SP5 | ca-certificates-mozilla | 2.92-150200.50.2 | SUSE-SU-2026:4847-1 |
| SLES for SAP 15 SP5 | ca-certificates-mozilla-prebuilt | 2.92-150200.50.3 | SUSE-SU-2026:4847-1 |
| SLES for SAP 15 SP4 | ca-certificates-mozilla | 2.92-150200.50.2 | SUSE-SU-2026:4847-1 |
| SLES for SAP 15 SP4 | ca-certificates-mozilla-prebuilt | 2.92-150200.50.3 | SUSE-SU-2026:4847-1 |
| SLES 16.0 | ca-certificates-mozilla | 2.92-160000.1.1 | SUSE-SU-2026:24361-1 |
| SLES 16.0 | ca-certificates-mozilla-prebuilt | 2.92-160000.1.4 | SUSE-SU-2026:24361-1 |
| SLE Micro 6.2 | ca-certificates-mozilla | 2.92-160000.1.1 | SUSE-SU-2026:24414-1 |
| SLE Micro 6.1 | ca-certificates-mozilla | 2.92-slfo.1.1_1.1 | SUSE-SU-2026:24383-1 |
| SLE Micro 6.0 | ca-certificates-mozilla | 2.92-159998.1.1 | SUSE-SU-2026:24373-1 |
| SLE Micro 5.5 | ca-certificates-mozilla | 2.92-150200.50.2 | SUSE-SU-2026:4847-1 |
| SLE Micro 5.4 | ca-certificates-mozilla | 2.92-150200.50.2 | SUSE-SU-2026:4847-1 |
| SLE Micro 5.3 | ca-certificates-mozilla | 2.92-150200.50.2 | SUSE-SU-2026:4847-1 |
| SLE HPC 15 SP5 | ca-certificates-mozilla | 2.92-150200.50.2 | SUSE-SU-2026:4847-1 |
| SLE HPC 15 SP5 | ca-certificates-mozilla-prebuilt | 2.92-150200.50.3 | SUSE-SU-2026:4847-1 |
| SLE HPC 15 SP4 | ca-certificates-mozilla | 2.92-150200.50.2 | SUSE-SU-2026:4847-1 |
| SLE HPC 15 SP4 | ca-certificates-mozilla-prebuilt | 2.92-150200.50.3 | SUSE-SU-2026:4847-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ca-certificates-mozilla | 2.92-2.1 | openSUSE-SU-2026:12233-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ca-certificates | 2025.2.76-1.0.amzn2023.0.5 | ALAS2023-2026-3337 |
| Amazon Linux 2 | ca-certificates | 2025.2.76-1.amzn2.0.4 | ALAS2-2026-4045 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | ca-certificates | 2026.2.92_v9.0.319-100.3.el10_2 | ELSA-2026-88455 |
| Oracle Linux 9 | ca-certificates | 2026.2.92_v9.0.319-90.3.el9_8 | ELSA-2026-88459 |
| Oracle Linux 8 | ca-certificates | 2026.2.92_v9.0.319-81.3.el8_10 | ELSA-2026-88550 |
| Oracle Linux 7 | ca-certificates | 2025.2.80_v9.0.304-71.0.2.el7_9 | ELSA-2026-500496 |
Advisories 37
- RHSA-2026:93044 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-botocore) security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:93045 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-botocore) security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:93046 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (python-botocore) security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:93043 Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 (python-botocore) security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88563 Red Hat Security Advisory: ca-certificates security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88562 Red Hat Security Advisory: ca-certificates security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:90985 Red Hat Security Advisory: ca-certificates and nss security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88779 Red Hat Security Advisory: ca-certificates security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88560 Red Hat Security Advisory: ca-certificates security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88669 Red Hat Security Advisory: ca-certificates security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88455 Red Hat Security Advisory: ca-certificates security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88662 Red Hat Security Advisory: ca-certificates security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88459 Red Hat Security Advisory: ca-certificates security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88564 Red Hat Security Advisory: ca-certificates security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88668 Red Hat Security Advisory: ca-certificates security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88550 Red Hat Security Advisory: ca-certificates security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:86595 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-4120 Red Hat Enterprise Linux ca-certificates: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 12, 2026
- ALAS2-2026-4045 Moderate: ca-certificates security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 2, 2026
- ALAS2023-2026-3337 Moderate: ca-certificates security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 2, 2026
- SUSE-SU-2026:24414-1 Security update for ca-certificates-mozilla SUSE / openSUSE Security Updates · Oct 30, 2026
- SUSE-SU-2026:24361-1 Security update for ca-certificates-mozilla SUSE / openSUSE Security Updates · Oct 29, 2026
- ALSA-2026:88459 Critical: ca-certificates security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:88455 Critical: ca-certificates security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:88550 Critical: ca-certificates security update AlmaLinux Security Advisories · Oct 29, 2026
- SUSE-SU-2026:24383-1 Security update for ca-certificates-mozilla SUSE / openSUSE Security Updates · Oct 27, 2026
- SUSE-SU-2026:24373-1 Security update for ca-certificates-mozilla SUSE / openSUSE Security Updates · Oct 27, 2026
- openSUSE-SU-2026:12233-1 ca-certificates-mozilla-2.92-2.1 on GA media SUSE / openSUSE Security Updates · Oct 24, 2026
- RLSA-2026:88550 Critical: ca-certificates security update Rocky Linux Security Advisories · Oct 24, 2026
- SUSE-SU-2026:4820-1 Security update for openssl-certs SUSE / openSUSE Security Updates · Oct 23, 2026
- SUSE-SU-2026:4847-1 Security update for ca-certificates-mozilla SUSE / openSUSE Security Updates · Oct 23, 2026
- RLSA-2026:88455 Critical: ca-certificates security update Rocky Linux Security Advisories · Oct 23, 2026
- RLSA-2026:88459 Critical: ca-certificates security update Rocky Linux Security Advisories · Oct 23, 2026
- ELSA-2026-88455 Critical: ca-certificates security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 23, 2026
- ELSA-2026-88459 Critical: ca-certificates security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 23, 2026
- ELSA-2026-88550 Critical: ca-certificates security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 23, 2026
- ELSA-2026-500496 Important: ca-certificates security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 23, 2026
References
- RHSA-2026:86595 vendor-advisory
- RHSA-2026:88455 vendor-advisory
- RHSA-2026:88459 vendor-advisory
- RHSA-2026:88550 vendor-advisory
- RHSA-2026:88560 vendor-advisory
- RHSA-2026:88562 vendor-advisory
- RHSA-2026:88563 vendor-advisory
- RHSA-2026:88564 vendor-advisory
- RHSA-2026:88662 vendor-advisory
- RHSA-2026:88668 vendor-advisory
- RHSA-2026:88669 vendor-advisory
- RHSA-2026:88779 vendor-advisory
- RHSA-2026:89081 vendor-advisory
- RHSA-2026:89131 vendor-advisory
- RHSA-2026:89197 vendor-advisory
- RHSA-2026:89232 vendor-advisory
- RHSA-2026:89333 vendor-advisory
- RHSA-2026:89651 vendor-advisory
- RHSA-2026:89714 vendor-advisory
- RHSA-2026:89725 vendor-advisory
- RHSA-2026:89838 vendor-advisory
- RHSA-2026:89907 vendor-advisory
- RHSA-2026:90272 vendor-advisory
- RHSA-2026:90969 vendor-advisory
- RHSA-2026:90985 vendor-advisory
- RHSA-2026:91202 vendor-advisory
- RHSA-2026:91204 vendor-advisory
- RHSA-2026:91206 vendor-advisory
- RHSA-2026:91207 vendor-advisory
- RHSA-2026:91217 vendor-advisory
- RHSA-2026:91218 vendor-advisory
- RHSA-2026:91219 vendor-advisory
- RHSA-2026:91224 vendor-advisory
- RHSA-2026:91232 vendor-advisory
- RHSA-2026:91233 vendor-advisory
- RHSA-2026:91234 vendor-advisory
- RHSA-2026:91235 vendor-advisory
- RHSA-2026:91236 vendor-advisory
- RHSA-2026:91237 vendor-advisory
- RHSA-2026:91238 vendor-advisory
- RHSA-2026:91241 vendor-advisory
- RHSA-2026:91242 vendor-advisory
- RHSA-2026:91243 vendor-advisory
- RHSA-2026:91244 vendor-advisory
- RHSA-2026:91245 vendor-advisory
- RHSA-2026:91246 vendor-advisory
- RHSA-2026:91248 vendor-advisory
- RHSA-2026:91249 vendor-advisory
- RHSA-2026:91997 vendor-advisory
- RHSA-2026:92006 vendor-advisory
- RHSA-2026:92342 vendor-advisory
- RHSA-2026:93043 vendor-advisory
- RHSA-2026:93044 vendor-advisory
- RHSA-2026:93045 vendor-advisory
- RHSA-2026:93046 vendor-advisory
- RHSA-2026:94459 vendor-advisory
- RHSA-2026:94468 vendor-advisory
- RHSA-2026:94474 vendor-advisory
- RHSA-2026:94476 vendor-advisory
- RHSA-2026:94562 vendor-advisory