Information for Python users regarding eMudhra / emSign CA certificate security
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Eight eMudhra intermediate CA certificates were compromised, and the Python ecosystem has shipped fixes. Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 now block the keys in the ssl module (CVE-2026-115557, CVSS 9.4). Separately, pip 26.2.2, certifi 2026.10.19 and uv 0.13.4 are recommended. Forum commenters say older pip keeps trusting the keys through its vendored certifi, and that the keys were trivially guessable; neither claim is sourced. Official Docker images still ship pip 26.2.1, so rebuild images and virtualenvs.