{"action":"Upgrade webpki-roots to 0.26.11 or later.","affected":[{"fixed":"0.26.11","introduced":"0.0.0-0"},{"fixed":"1.0.10","introduced":"0.26.12-0"}],"component":"webpki-roots","cve_ids":["CVE-2026-111943"],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.26.11","1.0.10"],"id":"tcs_01M5JK9FQFR5NQGY6C49JWVPDG","modified_at":"2026-10-21T06:30:02.818201920Z","published_at":"2026-10-19T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0381","https://crates.io/crates/webpki-roots","https://rustsec.org/advisories/RUSTSEC-2026-0381.html","https://github.com/rustls/webpki-roots/pull/133","https://emudhra.we-have-a-problem.com/","https://bugzilla.mozilla.org/show_bug.cgi?id=2083449"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0381","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0381"}],"summary":"Bundled root certificates allow trust in distrusted emSign intermediates"}