All vulnerabilities
GHSA-hq85-5cpj-mr62PYSEC-2026-4321

uv: uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

uvpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0.13.4Fixed versionGitHub
Published20 Oct 2026Updated 20 Oct 2026GitHub

What fixes it

  • 0.13.4uv, pipGitHub
  • 0.13.4uv, PyPIOSVpip install "uv>=0.13.4"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.

An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks.

uv 0.13.4 removes the root from its vendored bundle, following webpki-root-certs 1.0.10. Upgrade to 0.13.4 or later.

Text from GitHub Advisory Database

Affected versions 52

  • uv, pip< 0.13.4GitHub
  • uv, PyPIfrom first release, fixed in 0.13.4OSV
  • uv, PyPI0.0.5OSV
  • uv, PyPI0.1.0OSV
  • uv, PyPI0.1.1OSV
  • uv, PyPI0.1.10OSV
  • uv, PyPI0.1.11OSV
  • uv, PyPI0.1.12OSV
  • uv, PyPI0.1.13OSV
  • uv, PyPI0.1.14OSV
  • uv, PyPI0.1.15OSV
  • uv, PyPI0.1.16OSV
  • uv, PyPI0.1.17OSV
  • uv, PyPI0.1.18OSV
  • uv, PyPI0.1.19OSV
  • uv, PyPI0.1.2OSV
  • uv, PyPI0.1.20OSV
  • uv, PyPI0.1.21OSV
  • uv, PyPI0.1.22OSV
  • uv, PyPI0.1.23OSV
  • uv, PyPI0.1.24OSV
  • uv, PyPI0.1.25OSV
  • uv, PyPI0.1.26OSV
  • uv, PyPI0.1.27OSV
  • uv, PyPI0.1.28OSV
  • uv, PyPI0.1.29OSV
  • uv, PyPI0.1.3OSV
  • uv, PyPI0.1.30OSV
  • uv, PyPI0.1.31OSV
  • uv, PyPI0.1.32OSV
  • uv, PyPI0.1.33OSV
  • uv, PyPI0.1.34OSV
  • uv, PyPI0.1.35OSV
  • uv, PyPI0.1.36OSV
  • uv, PyPI0.1.37OSV
  • uv, PyPI0.1.38OSV
  • uv, PyPI0.1.39OSV
  • uv, PyPI0.1.4OSV
  • uv, PyPI0.1.40OSV
  • uv, PyPI0.1.41OSV
  • uv, PyPI0.1.42OSV
  • uv, PyPI0.1.43OSV
  • uv, PyPI0.1.44OSV
  • uv, PyPI0.1.45OSV
  • uv, PyPI0.1.5OSV
  • uv, PyPI0.1.6OSV
  • uv, PyPI0.1.7OSV
  • uv, PyPI0.1.8OSV
  • uv, PyPI0.1.9OSV
  • uv, PyPI0.10.0OSV
  • uv, PyPI0.10.1OSV
  • uv, PyPI0.10.10OSV

References 5