Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Bundled CA stores still carry compromised eMudhra certificate

1 source · 3 articlesFirst reported Updated ()
What's new

October 21: replies add webpki embeds, uv and Deno overrides, and 70 potentially affected Alpine edge packages.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Researchers say software shipping its own certificate stores may still trust a compromised eMudhra root, with no fix described.

Hanno Böck warned that the eMudhra certificate compromise can affect any software that ships its own root store. On October 20 he reported that Gentoo's texlive-core package, using an upstream texlive-infra file, includes the affected Comodo AAA Services certificate in curl-ca-bundle.crt. A follow-up puts nmap/ncat and other applications in scope and cites five NixOS nixpkgs issues where stores are compiled into binaries. LN Liberda says some Rust projects embed stores through webpki-root-certs and webpki-roots, including uv and Deno unless environment overrides are set. An Alpine Linux edge SBOM check found 29 community and 41 testing packages potentially affected. The posts describe no fix or exploitation.

Key facts
  • Affected certificate is Comodo AAA Services, linked to the eMudhra compromise.
  • Gentoo path reported: /usr/share/tlpkg/installer/curl/curl-ca-bundle.crt from texlive-core.
  • Böck cites NixOS nixpkgs issues 576475 and 576541 through 576544.
  • webpki-root-certs and webpki-roots can embed stores in Rust applications.
  • Alpine edge SBOM: 29 community and 41 testing packages potentially affected.
  • The posts describe neither a fix nor exploitation.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026Böck reports the cert in Gentoo's texlive CA bundle. · oss-security
  2. Oct 21, 2026Liberda flags webpki embeds and Alpine edge package counts. · oss-security
  3. Oct 21, 2026Böck cites five NixOS issues for more bundled stores. · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityBöck names the texlive bundle path and five NixOS issue numbers.
  • oss-securityLiberda names webpki crates, uv and Deno overrides, and Alpine counts.
Vendors
Alpine LinuxGentooNmapNixOS
Products
uvDenowebpki-rootswebpki-root-certstexlive-infratexlive-corenmapncatnixpkgs
Organizations
eMudhra

Coverage

oldest first · one row per article · UTC
  1. · 4d ago oss-securityFirst report

    Bundled root stores may include compromised eMudhra certificate

    Hanno Böck found the affected Comodo AAA Services certificate in Gentoo's texlive curl CA bundle.

  2. · 4d ago oss-security

    uv, Deno and Alpine packages bundle webpki root certificates

    An Alpine edge SBOM check found 29 community and 41 testing packages potentially affected.

  3. · 4d ago oss-security

    More apps bundle cert stores tied to the eMudhra certificate issue

    Hanno Böck points to several NixOS nixpkgs reports beyond nmap/ncat and texlive-infra.