PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113812 Mozilla CVE debrief

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes 'emSign ECC Root CA - G3', which provides a trust path for intermediate certificates whose private keys are publicly available. An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server. LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA. Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.

Vendor
Mozilla
Product
Mozilla::CA
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-30
Advisory published
2026-10-20
Advisory updated
2026-10-30

Who should care

Defenders responsible for systems using LWP, HTTP::Tiny, or other clients that rely on Mozilla::CA should verify the CA store used by these clients and ensure they are updated to Mozilla::CA version 20261020 or later. This is particularly important for systems that use the system CA store.

Why it matters

Defenders should prioritize verifying the CA store used by clients and updating to Mozilla::CA version 20261020 or later due to the potential for impersonation of TLS servers using compromised intermediate certificates.

  • An attacker could impersonate a TLS server using compromised intermediate certificates
  • Defenders need to verify the CA store used by clients and update to Mozilla::CA version 20261020 or later
  • Systems using LWP, HTTP::Tiny, or other clients that rely on Mozilla::CA are potentially affected

Technical summary

The Mozilla::CA module for Perl, versions before 20261020, includes a CA certificate bundle with a root certificate ('emSign ECC Root CA - G3') that is linked to compromised intermediate certificates. This could allow an attacker to impersonate a TLS server by using the publicly available private keys of these intermediates. Affected product deployments should be identified in managed environments. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance. Clients using LWP, HTTP::Tiny, or other clients that rely on Mozilla::CA should verify their CA store and update to Mozilla::CA version 20261020 or later.

Defensive priority

Defenders should prioritize verifying the CA store used by clients and updating to Mozilla::CA version 20261020 or later. This is particularly important for systems using LWP, HTTP::Tiny, or other clients that rely on Mozilla::CA.

Recommended defensive actions

  • Verify the CA store used by clients and update to Mozilla::CA version 20261020 or later
  • Check which CA store LWP, HTTP::Tiny, and other clients use
  • Install operating system vendor updates for this incident if the system store is used
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details about the vulnerability in Mozilla::CA versions before 20261020. The source item mentions that the bundle includes 'emSign ECC Root CA - G3', which is linked to compromised intermediates.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113812 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113812

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113812 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113812

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.