ca-certificates: Compromised Intermediate Certificate Authority — GLSA 202610-01

A vulnerability has been discovered in ca-certificates where an intermediate Certificate Authority has been compromised.

Package	app-misc/ca-certificates on all architectures
Affected versions	< 20260816.3.125
Unaffected versions	>= 20260816.3.125

For more information on the packages listed in this GLSA, please see their homepage referenced in the ebuild.

A vulnerability has been discovered in ca-certificates. Please review the CVE identifier referenced below for details.

Man-in-the-middle (MITM) attacks are possible using the compromised authority key.

There is no known workaround at this time.

All ca-certificates users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-misc/ca-certificates-20260816.3.125"

Release date
October 21, 2026

Latest revision
October 21, 2026: 1

Severity
high

Exploitable
remote

Bugzilla entries