Python certifi Update Removes emSign Root Certificate in Critical Patch
A critical update for the Python certifi library removes the emSign root certificate. Organizations using affected versions must review their dependencies.
Key points
- The certifi library version 2026.10.19 addresses a critical severity vulnerability.
- The update removes root certificates associated with the emSign issuer.
- The advisory was posted to the oss-security mailing list on October 20, 2026.
The Python security team has released a critical update for the certifi library, widely used for managing TLS certificates in Python applications. The release, version 2026.10.19, removes root certificates from the emSign issuer. This action addresses a vulnerability rated as critical severity. According to the advisory posted on the oss-security mailing list, the update is necessary to maintain secure certificate verification standards. Organizations relying on this library should assess their current installations immediately.
How it unfolded
- On October 20, 2026, Seth Larson posted an advisory to the security-announce mailing list regarding the certifi library.
- The advisory identified a critical severity vulnerability that required the removal of specific root certificates from the package.
- The update specifically targets the emSign root certificate, which is excluded in the newly released version 2026.10.19.
- The notice was forwarded to the oss-security mailing list by Alan Coopersmith to alert the broader security community.
Who is affected
Any system or application that depends on the certifi library for certificate validation is potentially affected by this change. The vulnerability is classified as critical, indicating a high level of risk if the compromised certificates remain in use. The update applies to the certifi package itself, so downstream projects that bundle or require specific versions of certifi may inherit this change. Users running versions older than 2026.10.19 do not have this mitigation. The advisory does not specify which applications are most at risk, but any Python-based service handling secure connections is within the scope.
Our take on the response
The decision to remove the emSign root certificate suggests a proactive stance on trust chain integrity. By issuing a critical rating, the maintainers signal that the presence of this certificate poses an unacceptable risk to users. The rapid publication of the advisory on public security lists ensures that system administrators and developers are informed promptly. This approach aligns with standard practices for high-severity vulnerabilities in core infrastructure libraries. That suggests the community should treat this update as a priority to prevent potential trust issues in their environments.
Who needs to act first
Managed service providers should prioritize updating systems that handle sensitive data or external communications. Teams usually start by identifying critical production servers that run Python applications dependent on certifi. It is advisable to test the update in a staging environment first to ensure compatibility with existing workflows. Check whether automated deployment pipelines can safely roll out the new version. Back up configuration files before making changes. If immediate updating is not possible, monitor logs for any unexpected certificate errors or connection failures while waiting for a full rollout.
What to do and how to stay safe: certifi
- Audit your Python environments to identify which applications rely on the certifi library and note their current versions.
- Review your dependency management policies to determine if updates can be applied automatically or require manual intervention.
- Monitor application logs for any TLS or certificate verification errors after applying the update to detect integration issues.
- Consult with development teams to ensure that removing the emSign certificate does not break any internal trust configurations.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The source material does not provide a CVE ID for this issue.
Does this update fix a software bug or just remove a certificate?
The update removes root certificates from the emSign issuer to address a critical severity vulnerability.
Is there a specific exploit being used in the wild?
The source material does not mention any active exploitation or specific attacks against this vulnerability.
