Skip to content

A CA private key was the number 4. Your curl still trusts it (CVE-2026-111943)

7.9 relevance
Score Breakdown
technical depth
8
novelty
9
actionability
8
community
6
strategic
7
personal
8

Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.

Critical CA vulnerability affecting curl/git/CI, highly technical and actionable.

Languages dev.to
A CA private key was the number 4. Your curl still trusts it (CVE-2026-111943)
Summary

Eight eMudhra intermediate CA keys were mis-generated — recoverable from the public certificates since April 2025. I recovered one in 4 guesses. Browsers are safe; your curl, git and CI may not be.

Author

Sam LABBE

More from Sam LABBE →