Oracle Java flaw CVE-2026-91403 allows unauthenticated remote attacks
The CVSS 9.1 JSSE issue concerns trust in compromised eMudhra intermediate certificates, not confirmed code execution.
74
- Mentions · 7d14
- Mentions · 30d14
- All mentions14
- First seenOct 20, 2026
- Last mentioned2d ago
Timeline
14 articles · newest firstOracle emergency Java update distrusts weak eMudhra CAs (CVE-2026-91403)
The CVSS 9.1 JSSE flaw can let an on-path attacker forge trusted hostnames; no attacks are confirmed.
76
Python users urged to prefer system stores after eMudhra CA incident
The reply says distribution pip and requests should use the system certifi store.
38
Firefox 153 ESR still trusts Comodo AAA, list reply says
Jakub Wilk says his Firefox 153 ESR still trusted the Comodo AAA certificate despite Mozilla bug 1957685.
36
PHP, Node.js, LiteLLM and an Indian CA hit in one day
NSA told PHP users to update or go offline; LiteLLM malicious packages stole credentials and included a RAT.
78
Gutmann cites Fermat checks for RSA keys with close primes
On the eMudhra intermediates thread, he says Let's Encrypt rejects public keys whose primes are too close.
28
badkeys author says he already scans CCADB certs for weak keys
Hanno Böck has not yet added checks for small ECDSA keys and plans a later write-up.
32
More apps bundle cert stores tied to the eMudhra certificate issue
Hanno Böck points to several NixOS nixpkgs reports beyond nmap/ncat and texlive-infra.
42
uv, Deno and Alpine packages bundle webpki root certificates
An Alpine edge SBOM check found 29 community and 41 testing packages potentially affected.
44
NSS 3.131.1 drops emSign certs amid eMudhra questions
Solar Designer asks whether another certificate still cross-signs the compromised intermediates.
42
Bundled root stores may include compromised eMudhra certificate
Hanno Böck found the affected Comodo AAA Services certificate in Gentoo's texlive curl CA bundle.
44
Eight eMudhra intermediate CA private keys compromised
The intermediates chain to roots in major browser programs, so bundled trust stores need updates.
90
Comodo AAA root trust removal unrelated to eMudhra
Browsers dropped the TLS trust bit because the root, issued in 2004, exceeds the CA/Browser Forum's 15-year maximum lifespan.
20
Go will reject certificate chains with eight distrusted SPKIs
A reader of the change says 16 certificates, all from eMudhra, appear to match.
52
Related CVEs
by mentions- JSSE trust flaw in Oracle Java SE and GraalVM
Appears with
- certifiproduct · 2
- texlive-infraproduct · 2
- ncatproduct · 2
- Oraclevendor · 2
- pipproduct · 2
- uvproduct · 2
- National Security Agencyorganization · 1
- Red Hatorganization · 1
- Let's Encryptorganization · 1
- Denoproduct · 1
- Remote Supportproduct · 1
- NixOSvendor · 1
- Firefoxproduct · 1
- Appleorganization · 1
- nixpkgsproduct · 1
- PHPproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.