Mozilla Revokes eMudhra Root After Key Leak, Ships Firefox 158.0.1 and NSS 3.131.1
Mozilla removed the root certificate behind eight compromised eMudhra intermediates (CVE-2026-111943) via OneCRL, Firefox 158.0.1 and NSS 3.131.1, while Debian, Ubuntu and Arch have shipped ca-certificates updates and administrators should patch systems, browsers, containers and appliances.
CVE-2026-111943 tracks the private key compromise of eight eMudhra intermediate certificates reported to Mozilla on 17 October 2026 at 20:06 UTC.
Mozilla pushed a OneCRL block to standard Firefox users by 22:59 UTC that same day. Because OneCRL only applies to Firefox, Mozilla also released Firefox 158.0.1, Firefox ESR 115.43.1, and Firefox ESR 153.5.1. NSS version 3.131.1 updates the trusted certificate list to remove the root certificate that signed the affected intermediates. This NSS change protects system-wide TLS clients like curl, wget, and language runtimes.
eMudhra stated on 20 October that the issue is limited to intermediate CA certificates created during an April 2025 key generation ceremony, claiming root CA private keys, other intermediates, and end-entity certificates remain unaffected.
Linux distributions began shipping patches on 20 October. Debian released ca-certificates version 20250419~deb12u2 at 15:45, Ubuntu pushed an update at 15:55, and Arch Linux built ca-certificates-mozilla at 10:11. Fedora, AlmaLinux, Rocky Linux, Amazon Linux, CentOS Stream, and openSUSE were unconfirmed when writing. Repology tracks versions but omits build dates.
Administrators must install updated ca-certificates packages, update Firefox, and check container images and appliances bundling their own trust stores.