Mozilla::CA before 20261020 includes a root tied to compromised intermediates
Original title: CVE-2026-113812: Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates
Stig Palmquist reported CVE-2026-113812 on October 20 against the libwww-perl CA bundle; the post is truncated.
An oss-security post says Perl Mozilla::CA versions before 20261020 ship a CA certificate bundle that contains a root linked to compromised intermediates. The report, CVE-2026-113812, points to the MetaCPAN distribution and the libwww-perl Mozilla-CA repository. The feed text ends before any fix or compromise details.
Unconfirmed: The mailing-list body is truncated, so the fixed release and compromise scope are not shown.
- The notice was posted by Stig Palmquist on October 20.
- The package is the Perl Mozilla::CA distribution from libwww-perl.
- Only versions before 20261020 are named as affected.
Impact: Trust store includes a root linked to compromised intermediates
| Product | Affected |
|---|---|
| libwww-perl Mozilla::CA | before 20261020 |
- 1.Replace Mozilla::CA builds from before 20261020 once a fixed bundle is confirmed.
- CVEs
- CVE-2026-113812
- Vendors
- libwww-perl
- Products
- Mozilla::CA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-113812 | Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates | 9.1 | — |
From the original article
Posted by Stig Palmquist on Oct 20 ======================================================================== https://metacpan. org/dist/Mozilla-CA https://github. com/libwww-perl/Mozilla-CA Mozilla::CA versions...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.