CVE-2026-113812: CWE-295 Improper Certificate Validation

The vulnerability in Mozilla::CA for Perl prior to version 20261020 involves improper certificate validation due to inclusion of the "emSign ECC Root CA - G3" root certificate. This root certificate enables trust chains for intermediate certificates with publicly compromised private keys. As a result, an attacker capable of intercepting or redirecting traffic could impersonate TLS servers by leveraging these compromised keys. The typical Perl HTTP clients (LWP, HTTP::Tiny) use IO::Socket::SSL, which checks OpenSSL's default CA locations first and then Mozilla::CA. Configuration or environment variables may override this behavior. Users should confirm which CA store is in use and update the system CA store if applicable.

An attacker with the ability to intercept or redirect client traffic may exploit the compromised intermediate certificates linked to the "emSign ECC Root CA - G3" root to impersonate TLS servers. This undermines the trust model of TLS connections, potentially allowing man-in-the-middle attacks. The impact depends on the CA store used by the client; if the system CA store is used and not updated, clients remain vulnerable.

Users should verify which CA certificate store their Perl HTTP clients use. If the system CA store is used, users must check for and install operating system vendor updates addressing this incident. For Mozilla::CA, upgrading to version 20261020 or later resolves the issue. Since no patch links are provided, users should rely on vendor advisories and system updates for remediation.