certifi-2026.10.19 (Python dependency)

[Joe Locash]

Hot off the presses:

From: Seth Larson <seth@python.org>
Date: Tue, 20 Oct 2026 14:03:26 +0000
To: security-announce@python.org
Reply-To: security-sig@python.org
Subject: [Security-announce][GHSA-6q48-6c7w-9gw2] CRITICAL security update for certifi, removal of emSign root certificate

There is a CRITICAL severity vulnerability affecting certifi.

Certifi 2026.10.19 removes root certificates from "emSign" from the root
store. These root certificates have intermediates which have been revoked
due to key compromise. A compromised key for a certificate authority can be
used to issue certificates to enable MITM attacks.
Upgrade to certifi 2026.10.19 and rebuild container images to refresh CA
certificate stores.

Please see the links for the latest information on affected versions:

*
https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2
*
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ

[Joe Locash]

No release notes that I can find.

Fixed at 38399bb0b0. Leaving open for SA.

[Bruce Dubbs]

Advisory sa-13.1-077 has been issued.