{"id":"CVE-2026-111943","kind":"vulnerability","aliases":["CVE-2026-111943","GO-2026-6809"],"related":[],"title":"Distrust compromised intermediate certificates in crypto/x509","description":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles\n\n### CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles\n\nBulletin ID: 2026-150-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/24/2026 20:00 PM PDT\n\nSummary:\n\nAWS-owned TLS trust bundles are certificate stores used by AWS services to validate outbound TLS connections to customer-configured endpoints, including identity provider endpoints, origin servers, and webhook destinations. We identified CVE-2026-111943, a cryptographic key-generation issue affecting an external Certificate Authority (eMudhra/emSign), whose intermediate CA private keys were trivially recoverable due to catastrophic entropy failures in P-384 key generation. Eight intermediate CA private keys (six TLS, two code-signing) were generated with scalar values of small integers, making them mathematically recoverable without specialized tooling. Please note, customers whose TLS clients enforce certificate revocation checking (OCSP or CRL fail-closed) are not affected, as the issuing CA revoked the affected intermediates on 2026-10-18, and the cross-signing CA revoked its copies on 2026-10-19.\n\nAffected roots:\n\n- AAA Certificate Services (SPKI SHA-256: bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3)\n- emSign Root TLS CA – G3 (SPKI SHA-256: c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9)\n- emSign ECC Root CA – G3 (SPKI SHA-256: 8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782)\n\nCurrent Mitigation Status:\n\n- Root removal changes for the shared AWS trust store were merged and deployed to the live version set on 2026-10-21.\n- AWS SDK for Python (boto3 / botocore) was updated and released to PyPI as version 1.43.117.\n- Amazon CloudFront is deploying root removal from the edge CA bundle by the target date of 2026-10-28.\n- Amazon Linux 2 and Amazon Linux 2023 updates are available now. Customers should update the ca-certificates package: sudo yum update ca-certificates. Please follow ALAS CVE-2026-113470 and CVE-2026-111943 for more details.\n- Amazon Corretto has released updated JDK versions across all supported lines with the affected roots removed.\n- Bottlerocket is publishing updated AMIs targeted for 2026-10-26, with the latest AMI parameters updated in commercial regions by 2026-10-28.\n- Application Load Balancer is removing the affected roots from the trust store used to validate identity provider endpoints for OIDC and JWT authentication. Application Load Balancers with OIDC or JWT authentication enabled are being updated between 2026-10-29 and 2026-10-31, and newly created Application Load Balancers are protected by 2026-11-02. Customers using OIDC or JWT authentication on Application Load Balancers are being notified through AWS Health. If an identity provider certificate chains to one of the affected roots, replace it with a certificate from an AWS-trusted Certificate Authority by 2026-10-28.\n- AWS Security Token Service (STS) and Amazon Cognito have completed deploying trust store updates, removing the affected roots used to validate outbound TLS connections to identity provider endpoints.\n- RDS for SQL Server is updating managed hosts to remove the affected roots, targeted for 2026-10-30. No customer action is required.\n- EMR is releasing updated versions targeted for 2026-10-31. Customers should update when available.\n\nMitigation Guidance:\n\n- Amazon CloudFront: Customers whose origin server certificates chain to one of the three affected roots may experience TLS validation failures as AWS removes the roots from the CloudFront edge CA bundle. Impacted customers have been notified through their Personal Health Dashboard. \n- Elastic Load Balancing (Application Load Balancer): AWS is notifying customers whose Application Load Balancers use OIDC or JWT authentication through AWS Health. If your identity provider endpoint presents a certificate that chains to one of the affected roots, replace it with a certificate from an AWS-trusted Certificate Authority by 2026-10-28. \n- Amazon Corretto: Customers should upgrade to the latest versions, which are now available for download. \n- Amazon Linux 2 and Amazon Linux 2023: Update for ca-certificates package is available now: sudo yum update ca-certificates \n- AWS SDK for Python (boto3 / botocore): AWS SDK for Python (boto3 / botocore): Update to botocore version 1.43.117 or later. \n- Bottlerocket: Customers running Bottlerocket-based workloads on Amazon Elastic Kubernetes Service (EKS) or Amazon Elastic Container Service (ECS) on AMI versions at or below v1.67.0 are affected until updated AMIs are available. Customers should apply the interim per-node trust override using the Bottlerocket API:\n\n## Interim per-node trust override\n\n```\napiclient apply <<'EOF'\n# emSign ECC Root CA - C3 (O=eMudhra Inc)\n# SHA-256 BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3\n[settings.pki.emsign-ecc-c3]\ntrusted = false\ndata = \"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNLekNDQWJHZ0F3SUJBZ0lLZTNHMmdsYTRFbnljcURBS0JnZ3Foa2pPUFFRREF6QmFNUXN3Q1FZRFZRUUdFd0pWVXpFVE1CRUcKQTFVRUN4TUtaVzFUYVdkdUlGQkxTVEVVTUJJR0ExVUVDaE1MWlUxMVpHaHlZU0JKYm1NeElEQWVCZ05WQkFNVEYyVnRVMmxuYmlCRgpRME1nVW05dmRDQkRRU0F0SUVNek1CNFhEVEU0TURJeE9ERTRNekF3TUZvWERUUXpNREl4T0RFNE16QXdNRm93V2pFTE1Ba0dBMVVFCkJoTUNWVk14RXpBUkJnTlZCQXNUQ21WdFUybG5iaUJRUzBreEZEQVNCZ05WQkFvVEMyVk5kV1JvY21FZ1NXNWpNU0F3SGdZRFZRUUQKRXhkbGJWTnBaMjRnUlVORElGSnZiM1FnUTBFZ0xTQkRNekIyTUJBR0J5cUdTTTQ5QWdFR0JTdUJCQUFpQTJJQUJQMmxZYTU3SmhBZAo2YmNpTUs0RzlJR3pzVUp4bFRtODAxTGpyNi81OHBjMWtqWkdEb2VWamJrNVd1bTczOUQreUFkQlBMdFZiNE9qYXZ0aXNJR0pBbkI5ClNNVks0K2tpVkNKTms3dENESzkzbkNPbWZkZGhFYzVseC9oLy92WHlxYU5DTUVBd0hRWURWUjBPQkJZRUZQdGFTTkNBSUVEeXFPa0EKQjJrWmQ2Zm13L1RQTUE0R0ExVWREd0VCL3dRRUF3SUJCakFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQW9HQ0NxR1NNNDlCQU1EQTJnQQpNR1VDTVFDMDJDOENpZjIyVEdLNlEwNFRoSEsxcnQwYzN0YTEzRmFQV0VCYUxkNGdUQ0tEeXBPb2Z1NFNRTWZXaDAvNDM0VUNNQndVClpPUjhsb01SbkxEUldtRkxwZzlKMHdEOG9memtwZjkvcmRjdzBNZDNmNzZCQjFVd1VDQVU5VmM0Q3FneFVRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\"\n\n# emSign ECC Root CA - G3 (O=eMudhra Technologies Limited)\n# SHA-256 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B\n[settings.pki.emsign-ecc-g3]\ntrusted = false\ndata = \"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNUakNDQWRPZ0F3SUJBZ0lLUFBZSHFXaHdEdHFMaERBS0JnZ3Foa2pPUFFRREF6QnJNUXN3Q1FZRFZRUUdFd0pKVGpFVE1CRUcKQTFVRUN4TUtaVzFUYVdkdUlGQkxTVEVsTUNNR0ExVUVDaE1jWlUxMVpHaHlZU0JVWldOb2JtOXNiMmRwWlhNZ1RHbHRhWFJsWkRFZwpNQjRHQTFVRUF4TVhaVzFUYVdkdUlFVkRReUJTYjI5MElFTkJJQzBnUnpNd0hoY05NVGd3TWpFNE1UZ3pNREF3V2hjTk5ETXdNakU0Ck1UZ3pNREF3V2pCck1Rc3dDUVlEVlFRR0V3SkpUakVUTUJFR0ExVUVDeE1LWlcxVGFXZHVJRkJMU1RFbE1DTUdBMVVFQ2hNY1pVMTEKWkdoeVlTQlVaV05vYm05c2IyZHBaWE1nVEdsdGFYUmxaREVnTUI0R0ExVUVBeE1YWlcxVGFXZHVJRVZEUXlCU2IyOTBJRU5CSUMwZwpSek13ZGpBUUJnY3Foa2pPUFFJQkJnVXJnUVFBSWdOaUFBUWpwUXk0TFJMMUtQT3hzdDNpQWhLQW5qbGZTVTJmeVNVMFdYVHN1d1ljCjU4QnlyK2l1TCtGQlZJY1VxRXF5Nkh5QzVsdHF0ZHl6ZGM2TEJ0Q0dJNzlHMVk0UFB3VDAxeHlTZnZhbFk4TDFYNDR1VDZFWUdRSXIKTWdxQ1pIMFdrOUdqUWpCQU1CMEdBMVVkRGdRV0JCUjhYUUtFRTlUTWlwdUJ6aGNjTGlrZW5FaGpRakFPQmdOVkhROEJBZjhFQkFNQwpBUVl3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFLQmdncWhrak9QUVFEQXdOcEFEQm1BakVBdnZOaHp3SVFIV1NWQjdnWWJvaUZCUytECkNCZVF5aCtLVE9nTkczcXhyZFdCQ1Vmdk82d0lCSHhjbWJIdFJ3ZlNBakVBbmJwVi9LbEs2TzN0NW5ZQlFudkkrR0RaalZHTFZUdjcKakh2clpRbkQrSmJOUjZpQzhoWlZkeVIrRWhDVkJDeWoKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\"\n\n# emSign Root CA - C1 (O=eMudhra Inc)\n# SHA-256 12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F\n[settings.pki.emsign-root-c1]\ntrusted = false\ndata = \"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURjekNDQWx1Z0F3SUJBZ0lMQUs3UEFMckV6ekw0UTdJd0RRWUpLb1pJaHZjTkFRRUxCUUF3VmpFTE1Ba0dBMVVFQmhNQ1ZWTXgKRXpBUkJnTlZCQXNUQ21WdFUybG5iaUJRUzBreEZEQVNCZ05WQkFvVEMyVk5kV1JvY21FZ1NXNWpNUnd3R2dZRFZRUURFeE5sYlZOcApaMjRnVW05dmRDQkRRU0F0SUVNeE1CNFhEVEU0TURJeE9ERTRNekF3TUZvWERUUXpNREl4T0RFNE16QXdNRm93VmpFTE1Ba0dBMVVFCkJoTUNWVk14RXpBUkJnTlZCQXNUQ21WdFUybG5iaUJRUzBreEZEQVNCZ05WQkFvVEMyVk5kV1JvY21FZ1NXNWpNUnd3R2dZRFZRUUQKRXhObGJWTnBaMjRnVW05dmRDQkRRU0F0SUVNeE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBeit1cAp1ZkdaQmN6WUtDRks4M00wVVlSV0VQV2dUeXdTNC9vVG1pZlF6L2w1R25SZkhYazUvRnY0Y0k3Z2tsTDM1Q1g1VklQWkhkUElXb1UvClhzZTJCKzQrd002YXI2eFdRaW81SlhEV3Y3VjdOcTJzOW5QY3pkY2Rpb09sK3l1UUZUZHJIQ1pIM0RzcFZwTnFzOEZxT3AwOTljR1gKT0ZnRml4d1I0K1MwdUYyRkhZUCtlRjhMUldnWVNLVkdjelE3L2cvSWRydkhHUE1GMFliemhlM251ZGt5clZXSXpxYTJrYkJQckg0VgpJNWIyUC9BZ05CYmVDc2JFQkVWNWY2Zjl2dEtwcGErY3hTTXE5endoYkwydmowN0ZPckx6TkJMODM0QWFTYVRVcVpYM25vbGVvb21zCmxNdW9hSnV2aW1VbnpZbnUzWXkxYXlsd1E2QnBDK1M1RHdJREFRQUJvMEl3UURBZEJnTlZIUTRFRmdRVS9xSGdjQjRxQXpsU1drSysKWEpHRmVoaXFUYlV3RGdZRFZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRApnZ0VCQU1KS1Z2b1ZJWHNvb3VubEhmdjRMY1E1bGtGTU95Y3N4R3dZRllER3JLOUhXUzhtQytNMnNPODcva09YU1RLWkVoVmIzeEVwCi82dFQrTHZCZUErc25GT3ZWNzFvakQxcE0vQ2pvQ05qTzJSbklrU3QxWEhMVmlwNGtxTlBFakUyTnVMZS9nREVvMkFQSjYyZ3NJcTEKTm5wU29iMG45Q0FuWXVoTmxDUVQ1QW9FNlR5ckxzaERDVXJHWVFUbFNUUiswOFRJOVEvQXF1bTZWRjd6WXl0UFQxRFUvcmw3bVl3OQp3QzY4QWl2VHhFRGtpZ2N4SHB2T0pwa1QreEhxbWlJTUVSbkhYaHVCVURESWxoSnU1OHRCZjVFN29rZTNWSUFiM0FETW1wRHF3OE5RCkJtSU1NTUFWU0tlb1dYemhyaUtpNGdwNkQvcGlxMUpNNGZIZnlyNkREVUk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\"\nEOF\n```\n\nReferences:\n\n- CVE-2026-111943\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Go's crypto/x509 package now rejects certificate chains that include a denylisted set of intermediate certificates that are no longer trusted. The sources describe this as a defensive denylist added where system trust stores may not have been updated, so the impact of the underlying gap is not stated.","severity":"unknown","cvss":null,"epss":0.00145,"exploited":false,"exploited_at":null,"products":[{"name":"stdlib","fixed":["1.26.10","1.27.3"],"affected":">= 1.27.0-0, < 1.27.3","ecosystem":"go"}],"ecosystems":["go"],"tags":["aws","go","lab-disclosure","runtime","self-hosted","tls"],"not_affected_if":["default-config"],"how_to_check":"Run go version on build and deploy hosts and check whether it is below 1.26.10 or in the 1.27.0 to 1.27.2 range.","fix":"Upgrade the Go toolchain to 1.26.10 or 1.27.3 and rebuild binaries.","status":"open","published_at":"2026-10-21T00:27:29+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:13:17+00:00","updated_at":"2026-10-25T04:26:14+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T20:13:17Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Go toolchain to 1.26.10 or 1.27.3 and rebuild binaries.\nunknown","summary":"Go's crypto/x509 package now rejects certificate chains that include a denylisted set of intermediate certificates that are no longer trusted. The sources describe this as a defensive denylist added where system trust stores may not have been updated, so the impact of the underlying gap is not stated.","category":"runtime","who_cares":["go","self-hosted","tls"],"confidence":0.6,"analyst_note":"","how_to_check":"Run go version on build and deploy hosts and check whether it is below 1.26.10 or in the 1.27.0 to 1.27.2 range.\nunknown","needs_analyst":false,"not_affected_if":["default-config"],"severity_if_unknown":"unknown"},"cost_usd":0.000356,"input_tokens":2127,"output_tokens":286,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-02':474C '-10':242C,255C,307C,341C,405C,418C,457C,461C,517C,563C,578C '-11':473C '-111943':9A,15A,78C,90C,156C,377C '-113470':373C '-150':103C '-18':243C '-19':256C '-2026':8A,11A,14A,77C,89C,155C,372C,376C '-21':308C '-256':264C,273C,282C '-26':406C '-28':342C,419C,518C '-29':458C '-30':564C '-31':462C,579C '-384':184C '-6809':12A '00':116C '1.43.117':323C '10/24/2026':114C '2':345C '20':115C '2023':349C '2026':102C,241C,254C,306C,340C,404C,417C,456C,460C,472C,516C,562C,577C '8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782':283C 'aaa':259C 'across':388C 'action':567C 'add':56B 'affect':163C,231C,238C,257C,394C,426C,501C,535C,558C,600C,664C 'ala':370C 'amazon':324C,343C,347C,381C,525C,587C 'ami':401C,410C 'applic':420C,443C,466C,482C,631C,639C 'attent':111C 'authent':442C,450C,480C,646C 'author':167C,514C 'avail':352C,584C 'aw':17B,85C,97C,104C,106C,121C,131C,293C,309C,489C,511C,519C,608C,634C,648C 'aws-own':120C 'aws-trust':510C 'balanc':422C,445C,468C,484C,630C,633C,641C 'bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3':265C 'boto3':313C 'botocor':314C 'bottlerocket':397C 'bulletin':100C 'bundl':87C,99C,125C,334C,617C 'c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9':274C 'ca':81C,93C,171C,189C,235C,249C,269C,278C,333C,359C,366C,616C 'ca-certif':358C,365C 'catastroph':179C 'certif':4A,33B,42B,127C,166C,220C,260C,360C,367C,495C,507C,513C,593C,657C 'chain':34B,496C,594C,659C 'chang':289C 'check':222C 'client':218C 'close':228C 'cloudfront':325C,588C,614C 'code':196C 'code-sign':195C 'cognito':526C 'commerci':414C 'complet':528C 'compromis':2A 'configur':141C 'connect':137C,542C 'content':107C 'copi':252C 'corretto':382C 'creat':465C 'crl':225C 'cross':247C 'cross-sign':246C 'crypto/x509':6A,29B 'cryptograph':158C 'current':284C 'custom':140C,215C,354C,475C,566C,580C,589C,619C,637C 'customer-configur':139C 'cve':7A,13A,76C,88C,154C,371C,375C 'dashboard':627C 'date':113C,338C 'defens':54B 'denylist':38B,55B 'deploy':299C,327C,529C 'describ':50B 'destin':151C 'detail':380C 'disclosur':21B 'distrust':1A 'due':177C 'ecc':276C 'edg':332C,615C 'eight':187C 'elast':628C 'emr':570C 'emsign':266C,275C 'emudhra':79C,91C 'emudhra/emsign':168C 'enabl':451C 'endpoint':142C,146C,437C,546C,654C 'enforc':219C 'entropi':180C 'experi':603C 'extern':165C 'fail':227C 'fail-clos':226C 'failur':181C,606C 'follow':369C 'g3':270C,279C 'gap':72B 'generat':161C,186C,199C 'go':10A,18B,27B 'guidanc':586C 'health':490C,626C,649C 'host':25B,554C 'id':101C 'ident':144C,435C,493C,544C,652C 'identifi':153C 'impact':68B,618C 'import':109C 'includ':36B,143C 'integ':205C 'intermedi':3A,41B,80C,92C,170C,188C,239C 'issu':162C,234C 'jdk':386C 'jwt':441C,449C,479C,645C 'key':82C,94C,160C,173C,185C,191C 'key-gener':159C 'lab':20B 'lab-disclosur':19B 'latest':409C 'line':391C 'linux':344C,348C 'live':302C 'load':421C,444C,467C,483C,629C,632C,640C 'longer':46B 'make':206C 'manag':553C 'mathemat':208C 'may':61B,602C 'merg':297C 'mitig':285C,585C 'newli':464C 'note':214C 'notifi':487C,622C,636C 'ocsp':223C 'oidc':439C,447C,477C,643C 'one':498C,596C,661C 'origin':147C,591C 'outbound':135C,540C 'own':122C 'p':183C 'packag':30B,361C 'paramet':411C 'pdt':118C 'person':625C 'pleas':213C,368C 'pm':117C 'present':655C 'privat':172C,190C 'protect':470C 'provid':145C,436C,494C,545C,653C 'public':112C 'publish':399C 'pypi':320C 'python':312C 'rds':547C 'recover':176C,209C 'recoveri':83C,95C 'region':415C 'reject':32B 'releas':318C,384C,572C 'remov':288C,329C,396C,424C,533C,556C,609C 'replac':503C 'requir':110C,569C 'revoc':221C 'revok':236C,250C 'roo':665C 'root':258C,267C,277C,287C,328C,395C,427C,502C,536C,559C,601C,611C 'runtim':22B 'scalar':201C 'scope':105C 'sdk':310C 'secur':520C 'self':24B 'self-host':23B 'server':148C,550C,592C 'servic':132C,261C,522C 'set':39B,304C 'sha':263C,272C,281C 'share':292C 'sign':197C,248C 'six':192C 'small':204C 'sourc':49B 'special':211C 'spki':262C,271C,280C 'sql':549C 'state':75B 'status':286C 'stdlib':16A 'store':60B,128C,295C,431C,531C 'sts':523C 'sudo':362C 'summari':119C 'support':390C 'system':58B 'target':337C,402C,560C,575C 'three':599C 'tls':26B,123C,136C,193C,217C,268C,541C,604C 'token':521C 'tool':212C 'trivial':175C 'trust':47B,59B,86C,98C,124C,294C,430C,512C,530C 'two':194C 'type':108C 'under':71B 'updat':65B,316C,350C,356C,364C,385C,400C,412C,454C,532C,552C,573C,582C 'use':129C,432C,476C,537C,642C 'valid':134C,434C,539C,605C 'valu':202C 'version':303C,322C,387C,574C 'webhook':150C 'whose':169C,216C,590C,638C 'without':210C 'yum':363C","nicknames":[],"mitigations":[{"kind":"platform-fix","scope":"AWS SDK for Python (boto3 / botocore)","since":null,"covers":"boto3/botocore release 1.43.117 with affected roots removed","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","vendor":"AWS","seen_at":"2026-10-25T04:26:13Z","confidence":0.9,"source_title":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles","customer_action":"Update to botocore version 1.43.117 or later"},{"kind":"platform-fix","scope":"Amazon Corretto","since":null,"covers":"Updated JDK versions across all supported lines with affected roots removed","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","vendor":"AWS","seen_at":"2026-10-25T04:26:13Z","confidence":0.9,"source_title":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles","customer_action":"Upgrade to the latest Corretto versions"},{"kind":"platform-fix","scope":"AWS Security Token Service (STS) and Amazon Cognito","since":null,"covers":"Outbound TLS validation to identity provider endpoints with affected roots removed","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","vendor":"AWS","seen_at":"2026-10-25T04:26:13Z","confidence":0.85,"source_title":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles","customer_action":"none stated"},{"kind":"platform-fix","scope":null,"since":"2026-10-21","covers":"AWS shared trust store: affected eMudhra roots removed from the live version set","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","vendor":"AWS","seen_at":"2026-10-25T04:26:13Z","confidence":0.9,"source_title":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles","customer_action":"none stated"},{"kind":"platform-fix","scope":"Amazon Linux 2 and Amazon Linux 2023","since":"2026-10-24","covers":"ca-certificates package update removing affected roots","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","vendor":"AWS","seen_at":"2026-10-25T04:26:13Z","confidence":0.9,"source_title":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles","customer_action":"Run sudo yum update ca-certificates"},{"kind":"platform-fix","scope":"Amazon CloudFront edge CA bundle","since":"2026-10-28","covers":"Root removal from the CloudFront edge CA bundle, targeted by 2026-10-28","limits":"Origin server certificates chaining to the affected roots may fail TLS validation during removal","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","vendor":"AWS","seen_at":"2026-10-25T04:26:13Z","confidence":0.8,"source_title":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles","customer_action":"Customers whose origin certificates chain to the affected roots were notified via Personal Health Dashboard and must address validation failures"},{"kind":"platform-fix","scope":"Bottlerocket AMIs on EKS and ECS","since":"2026-10-28","covers":"Updated Bottlerocket AMIs with latest AMI parameters in commercial regions","limits":"AMI versions at or below v1.67.0 remain affected until updated AMIs are available","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","vendor":"AWS","seen_at":"2026-10-25T04:26:13Z","confidence":0.8,"source_title":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles","customer_action":"Update to updated AMIs when available; interim per-node trust override can be applied via the Bottlerocket API"},{"kind":"platform-fix","scope":"Application Load Balancer OIDC and JWT authentication","since":"2026-10-29","covers":"Trust store used to validate identity provider endpoints, with affected roots removed; updates between 2026-10-29 and 2026-10-31, new ALBs protected by 2026-11-02","limits":"Identity provider certificates chaining to affected roots are not protected in the interim","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","vendor":"AWS","seen_at":"2026-10-25T04:26:13Z","confidence":0.85,"source_title":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles","customer_action":"Replace any identity provider certificate chaining to an affected root with one from an AWS-trusted CA by 2026-10-28"},{"kind":"platform-fix","scope":"RDS for SQL Server managed hosts","since":"2026-10-30","covers":"Managed hosts updated to remove affected roots, targeted for 2026-10-30","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","vendor":"AWS","seen_at":"2026-10-25T04:26:13Z","confidence":0.85,"source_title":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles","customer_action":"No customer action required"},{"kind":"platform-fix","scope":"Amazon EMR","since":"2026-10-31","covers":"Updated EMR versions targeted for 2026-10-31","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","vendor":"AWS","seen_at":"2026-10-25T04:26:13Z","confidence":0.8,"source_title":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles","customer_action":"Update to updated versions when available"}],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T00:27:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6809","url":"https://pkg.go.dev/vuln/GO-2026-6809","severity":null,"published_at":"2026-10-21T00:27:29+00:00","modified_at":"2026-10-21T00:27:29+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111943","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111943","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-111943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111943","severity":null,"published_at":"2026-10-21T01:17:20+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T19:14:51+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/#CVE-2026-111943","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","severity":null,"published_at":"2026-10-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-25T04:26:14+00:00","fetched_at":"2026-10-25T04:26:14+00:00","note":"AWS: CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles"}],"documents":[{"id":3393,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws/","title":"AWS: CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles","kind":"advisory","source":"lab","text":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles\n\n### CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles\n\nBulletin ID: 2026-150-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/24/2026 20:00 PM PDT\n\nSummary:\n\nAWS-owned TLS trust bundles are certificate stores used by AWS services to validate outbound TLS connections to customer-configured endpoints, including identity provider endpoints, origin servers, and webhook destinations. We identified CVE-2026-111943, a cryptographic key-generation issue affecting an external Certificate Authority (eMudhra/emSign), whose intermediate CA private keys were trivially recoverable due to catastrophic entropy failures in P-384 key generation. Eight intermediate CA private keys (six TLS, two code-signing) were generated with scalar values of small integers, making them mathematically recoverable without specialized tooling. Please note, customers whose TLS clients enforce certificate revocation checking (OCSP or CRL fail-closed) are not affected, as the issuing CA revoked the affected intermediates on 2026-10-18, and the cross-signing CA revoked its copies on 2026-10-19.\n\nAffected roots:\n\n- AAA Certificate Services (SPKI SHA-256: bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3)\n- emSign Root TLS CA – G3 (SPKI SHA-256: c619e4780ed8e0abeda24ad732567de4383a7ea941338f6d1a7d1b49ac792fe9)\n- emSign ECC Root CA – G3 (SPKI SHA-256: 8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782)\n\nCurrent Mitigation Status:\n\n- Root removal changes for the shared AWS trust store were merged and deployed to the live version set on 2026-10-21.\n- AWS SDK for Python (boto3 / botocore) was updated and released to PyPI as version 1.43.117.\n- Amazon CloudFront is deploying root removal from the edge CA bundle by the target date of 2026-10-28.\n- Amazon Linux 2 and Amazon Linux 2023 updates are available now. Customers should update the ca-certificates package: sudo yum update ca-certificates. Please follow ALAS CVE-2026-113470 and CVE-2026-111943 for more details.\n- Amazon Corretto has released updated JDK versions across all supported lines with the affected roots removed.\n- Bottlerocket is publishing updated AMIs targeted for 2026-10-26, with the latest AMI parameters updated in commercial regions by 2026-10-28.\n- Application Load Balancer is removing the affected roots from the trust store used to validate identity provider endpoints for OIDC and JWT authentication. Application Load Balancers with OIDC or JWT authentication enabled are being updated between 2026-10-29 and 2026-10-31, and newly created Application Load Balancers are protected by 2026-11-02. Customers using OIDC or JWT authentication on Application Load Balancers are being notified through AWS Health. If an identity provider certificate chains to one of the affected roots, replace it with a certificate from an AWS-trusted Certificate Authority by 2026-10-28.\n- AWS Security Token Service (STS) and Amazon Cognito have completed deploying trust store updates, removing the affected roots used to validate outbound TLS connections to identity provider endpoints.\n- RDS for SQL Server is updating managed hosts to remove the affected roots, targeted for 2026-10-30. No customer action is required.\n- EMR is releasing updated versions targeted for 2026-10-31. Customers should update when available.\n\nMitigation Guidance:\n\n- Amazon CloudFront: Customers whose origin server certificates chain to one of the three affected roots may experience TLS validation failures as AWS removes the roots from the CloudFront edge CA bundle. Impacted customers have been notified through their Personal Health Dashboard. \n- Elastic Load Balancing (Application Load Balancer): AWS is notifying customers whose Application Load Balancers use OIDC or JWT authentication through AWS Health. If your identity provider endpoint presents a certificate that chains to one of the affected roots, replace it with a certificate from an AWS-trusted Certificate Authority by 2026-10-28. \n- Amazon Corretto: Customers should upgrade to the latest versions, which are now available for download. \n- Amazon Linux 2 and Amazon Linux 2023: Update for ca-certificates package is available now: sudo yum update ca-certificates \n- AWS SDK for Python (boto3 / botocore): AWS SDK for Python (boto3 / botocore): Update to botocore version 1.43.117 or later. \n- Bottlerocket: Customers running Bottlerocket-based workloads on Amazon Elastic Kubernetes Service (EKS) or Amazon Elastic Container Service (ECS) on AMI versions at or below v1.67.0 are affected until updated AMIs are available. Customers should apply the interim per-node trust override using the Bottlerocket API:\n\n## Interim per-node trust override\n\n```\napiclient apply <<'EOF'\n# emSign ECC Root CA - C3 (O=eMudhra Inc)\n# SHA-256 BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3\n[settings.pki.emsign-ecc-c3]\ntrusted = false\ndata = \"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNLekNDQWJHZ0F3SUJBZ0lLZTNHMmdsYTRFbnljcURBS0JnZ3Foa2pPUFFRREF6QmFNUXN3Q1FZRFZRUUdFd0pWVXpFVE1CRUcKQTFVRUN4TUtaVzFUYVdkdUlGQkxTVEVVTUJJR0ExVUVDaE1MWlUxMVpHaHlZU0JKYm1NeElEQWVCZ05WQkFNVEYyVnRVMmxuYmlCRgpRME1nVW05dmRDQkRRU0F0SUVNek1CNFhEVEU0TURJeE9ERTRNekF3TUZvWERUUXpNREl4T0RFNE16QXdNRm93V2pFTE1Ba0dBMVVFCkJoTUNWVk14RXpBUkJnTlZCQXNUQ21WdFUybG5iaUJRUzBreEZEQVNCZ05WQkFvVEMyVk5kV1JvY21FZ1NXNWpNU0F3SGdZRFZRUUQKRXhkbGJWTnBaMjRnUlVORElGSnZiM1FnUTBFZ0xTQkRNekIyTUJBR0J5cUdTTTQ5QWdFR0JTdUJCQUFpQTJJQUJQMmxZYTU3SmhBZAo2YmNpTUs0RzlJR3pzVUp4bFRtODAxTGpyNi81OHBjMWtqWkdEb2VWamJrNVd1bTczOUQreUFkQlBMdFZiNE9qYXZ0aXNJR0pBbkI5ClNNVks0K2tpVkNKTms3dENESzkzbkNPbWZkZGhFYzVseC9oLy92WHlxYU5DTUVBd0hRWURWUjBPQkJZRUZQdGFTTkNBSUVEeXFPa0EKQjJrWmQ2Zm13L1RQTUE0R0ExVWREd0VCL3dRRUF3SUJCakFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQW9HQ0NxR1NNNDlCQU1EQTJnQQpNR1VDTVFDMDJDOENpZjIyVEdLNlEwNFRoSEsxcnQwYzN0YTEzRmFQV0VCYUxkNGdUQ0tEeXBPb2Z1NFNRTWZXaDAvNDM0VUNNQndVClpPUjhsb01SbkxEUldtRkxwZzlKMHdEOG9memtwZjkvcmRjdzBNZDNmNzZCQjFVd1VDQVU5VmM0Q3FneFVRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\"\n\n# emSign ECC Root CA - G3 (O=eMudhra Technologies Limited)\n# SHA-256 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B\n[settings.pki.emsign-ecc-g3]\ntrusted = false\ndata = \"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNUakNDQWRPZ0F3SUJBZ0lLUFBZSHFXaHdEdHFMaERBS0JnZ3Foa2pPUFFRREF6QnJNUXN3Q1FZRFZRUUdFd0pKVGpFVE1CRUcKQTFVRUN4TUtaVzFUYVdkdUlGQkxTVEVsTUNNR0ExVUVDaE1jWlUxMVpHaHlZU0JVWldOb2JtOXNiMmRwWlhNZ1RHbHRhWFJsWkRFZwpNQjRHQTFVRUF4TVhaVzFUYVdkdUlFVkRReUJTYjI5MElFTkJJQzBnUnpNd0hoY05NVGd3TWpFNE1UZ3pNREF3V2hjTk5ETXdNakU0Ck1UZ3pNREF3V2pCck1Rc3dDUVlEVlFRR0V3SkpUakVUTUJFR0ExVUVDeE1LWlcxVGFXZHVJRkJMU1RFbE1DTUdBMVVFQ2hNY1pVMTEKWkdoeVlTQlVaV05vYm05c2IyZHBaWE1nVEdsdGFYUmxaREVnTUI0R0ExVUVBeE1YWlcxVGFXZHVJRVZEUXlCU2IyOTBJRU5CSUMwZwpSek13ZGpBUUJnY3Foa2pPUFFJQkJnVXJnUVFBSWdOaUFBUWpwUXk0TFJMMUtQT3hzdDNpQWhLQW5qbGZTVTJmeVNVMFdYVHN1d1ljCjU4QnlyK2l1TCtGQlZJY1VxRXF5Nkh5QzVsdHF0ZHl6ZGM2TEJ0Q0dJNzlHMVk0UFB3VDAxeHlTZnZhbFk4TDFYNDR1VDZFWUdRSXIKTWdxQ1pIMFdrOUdqUWpCQU1CMEdBMVVkRGdRV0JCUjhYUUtFRTlUTWlwdUJ6aGNjTGlrZW5FaGpRakFPQmdOVkhROEJBZjhFQkFNQwpBUVl3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFLQmdncWhrak9QUVFEQXdOcEFEQm1BakVBdnZOaHp3SVFIV1NWQjdnWWJvaUZCUytECkNCZVF5aCtLVE9nTkczcXhyZFdCQ1Vmdk82d0lCSHhjbWJIdFJ3ZlNBakVBbmJwVi9LbEs2TzN0NW5ZQlFudkkrR0RaalZHTFZUdjcKakh2clpRbkQrSmJOUjZpQzhoWlZkeVIrRWhDVkJDeWoKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\"\n\n# emSign Root CA - C1 (O=eMudhra Inc)\n# SHA-256 12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F\n[settings.pki.emsign-root-c1]\ntrusted = false\ndata = \"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURjekNDQWx1Z0F3SUJBZ0lMQUs3UEFMckV6ekw0UTdJd0RRWUpLb1pJaHZjTkFRRUxCUUF3VmpFTE1Ba0dBMVVFQmhNQ1ZWTXgKRXpBUkJnTlZCQXNUQ21WdFUybG5iaUJRUzBreEZEQVNCZ05WQkFvVEMyVk5kV1JvY21FZ1NXNWpNUnd3R2dZRFZRUURFeE5sYlZOcApaMjRnVW05dmRDQkRRU0F0SUVNeE1CNFhEVEU0TURJeE9ERTRNekF3TUZvWERUUXpNREl4T0RFNE16QXdNRm93VmpFTE1Ba0dBMVVFCkJoTUNWVk14RXpBUkJnTlZCQXNUQ21WdFUybG5iaUJRUzBreEZEQVNCZ05WQkFvVEMyVk5kV1JvY21FZ1NXNWpNUnd3R2dZRFZRUUQKRXhObGJWTnBaMjRnVW05dmRDQkRRU0F0SUVNeE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBeit1cAp1ZkdaQmN6WUtDRks4M00wVVlSV0VQV2dUeXdTNC9vVG1pZlF6L2w1R25SZkhYazUvRnY0Y0k3Z2tsTDM1Q1g1VklQWkhkUElXb1UvClhzZTJCKzQrd002YXI2eFdRaW81SlhEV3Y3VjdOcTJzOW5QY3pkY2Rpb09sK3l1UUZUZHJIQ1pIM0RzcFZwTnFzOEZxT3AwOTljR1gKT0ZnRml4d1I0K1MwdUYyRkhZUCtlRjhMUldnWVNLVkdjelE3L2cvSWRydkhHUE1GMFliemhlM251ZGt5clZXSXpxYTJrYkJQckg0VgpJNWIyUC9BZ05CYmVDc2JFQkVWNWY2Zjl2dEtwcGErY3hTTXE5endoYkwydmowN0ZPckx6TkJMODM0QWFTYVRVcVpYM25vbGVvb21zCmxNdW9hSnV2aW1VbnpZbnUzWXkxYXlsd1E2QnBDK1M1RHdJREFRQUJvMEl3UURBZEJnTlZIUTRFRmdRVS9xSGdjQjRxQXpsU1drSysKWEpHRmVoaXFUYlV3RGdZRFZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRApnZ0VCQU1KS1Z2b1ZJWHNvb3VubEhmdjRMY1E1bGtGTU95Y3N4R3dZRllER3JLOUhXUzhtQytNMnNPODcva09YU1RLWkVoVmIzeEVwCi82dFQrTHZCZUErc25GT3ZWNzFvakQxcE0vQ2pvQ05qTzJSbklrU3QxWEhMVmlwNGtxTlBFakUyTnVMZS9nREVvMkFQSjYyZ3NJcTEKTm5wU29iMG45Q0FuWXVoTmxDUVQ1QW9FNlR5ckxzaERDVXJHWVFUbFNUUiswOFRJOVEvQXF1bTZWRjd6WXl0UFQxRFUvcmw3bVl3OQp3QzY4QWl2VHhFRGtpZ2N4SHB2T0pwa1QreEhxbWlJTUVSbkhYaHVCVURESWxoSnU1OHRCZjVFN29rZTNWSUFiM0FETW1wRHF3OE5RCkJtSU1NTUFWU0tlb1dYemhyaUtpNGdwNkQvcGlxMUpNNGZIZnlyNkREVUk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\"\nEOF\n```\n\nReferences:\n\n- CVE-2026-111943\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-24T00:00:00+00:00","relation":"advisory","confidence":null,"note":"AWS disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}