Improper Certificate Validation Affecting certifi package, versions [2019.3.9,2026.10.19)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-CERTIFI-21280764
- published20 Oct 2026
- disclosed20 Oct 2026
- creditUnknown
Introduced: 20 Oct 2026
New CVE NOT AVAILABLE CWE-295 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade certifi to version 2026.10.19 or higher.
Overview
Affected versions of this package are vulnerable to Improper Certificate Validation via the cacert.pem bundle, which was missing several emSign root CA certificates (emSign Root CA - G1, emSign Root CA - C1, and emSign ECC Root CA - C3) that were incorrectly removed in a prior release. An attacker positioned between a client and a server whose certificate chains to one of these omitted roots can present a certificate that the affected bundle fails to validate, enabling MitM interception of TLS-protected traffic.