certifi 2026.10.19 removes the emSign root in a critical update
Original title: [oss-security][GHSA-6q48-6c7w-9gw2] CRITICAL security update for certifi, removal of emSign root certificate
Python's security list rates GHSA-6q48-6c7w-9gw2 critical; the forwarded note says certifi 2026.10.19 drops the emSign root.
Seth Larson announced a critical vulnerability in certifi on the Python security-announce list, forwarded to oss-security by Alan Coopersmith on October 20. The fix, certifi 2026.10.19, removes the emSign root certificate. The forwarded excerpt ends before describing the flaw, affected versions, or exploitation.
Unconfirmed: The excerpt does not describe the vulnerability mechanism or say whether it was exploited.
- The advisory identifier is GHSA-6q48-6c7w-9gw2.
- Python's announcement calls the certifi issue critical.
- The stated fix release is certifi 2026.10.19.
- The message was dated October 20, 2026.
Impact: Continued trust of a removed emSign root
| Product | Affected | Fixed in |
|---|---|---|
| Python certifi | — | 2026.10.19 |
- 1.Upgrade certifi to 2026.10.19.
From the original article
Posted by Alan Coopersmith on Oct 20 -------- Forwarded Message -------- Subject: [Security-announce][GHSA-6q48-6c7w-9gw2] CRITICAL security update for certifi, removal of emSign root certificate Date: Tue, 20 Oct 2026 14:03:26 +0000 From: Seth Larson Reply-To: security-sig () python org To: security-announce () python org There is a CRITICAL severity vulnerability affecting certifi. Certifi 2026. 10.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.