Weak eMudhra Certificate Keys Prompt Browser Blocks and Software Updates
Summary
Eight eMudhra intermediate certificates had weak private keys that could be recovered by testing 256 values, enabling forged trusted certificates. eMudhra revoked them, and browser and software vendors issued protections and updates; misuse has not been evidenced.
Key points
- Researchers found eight eMudhra intermediate certificates used P-384 keys with values below 256, making recovery possible by testing just 256 values.
- A researcher published a compromised private key; BleepingComputer verified it matched a revoked certificate.
- The weakness could have enabled attackers to forge trusted certificates and impersonate legitimate websites, but there is no evidence the keys were used for that purpose.
- eMudhra attributed the weak keys to a certificate-generation script error and said it found no evidence the certificates had issued end-user certificates.
- eMudhra revoked all eight certificates and stopped issuing certificates under its G3 root; Mozilla, Google, and Apple also blocked affected certificates.
- Firefox updates, Go releases 1.27.3 and 1.26.10, and updates for other software address the issue, tracked as CVE-2026-111943. Some systems may continue trusting the certificates until updated, especially if they use their own certificate stores or do not check revocations.
Article Details
- Vulnerability Types
- Weak private-key generation
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Install available software updates to stop trusting the compromised certificates.
CVE
People
Dennis JacksonMozilla cryptography engineer who published an incident-tracking website listing affected software and security updates.FlüpkeSecurity researcher who published one of the compromised private keys on GitHub to demonstrate the weakness.WayneSecurity researcher who discovered the weakness while scanning publicly available certificate data.
Vendors
Products
GoThe Go development team released versions 1.27.3 and 1.26.10 to address the issue, tracked as CVE-2026-111943.Google ChromeGoogle Chrome also blocked the six compromised intermediates authorized to issue TLS certificates that day, while Apple added protections on October 19.Mozilla FirefoxMozilla said it blocked the compromised certificates through Firefox's OneCRL system on October 17, protecting users without requiring a browser update or restart.