Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates.

Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well known.

Version 1.0.10+ removes this root.

Version 0.26.11 is a compatibility wrapper that re-exports parent::TLS SERVER ROOT CERTS from its webpki-root-certs 1.x dependency; it contains no separate root certificate list. Its resolved 1.x dependency must be updated to 1.0.10 or later.