The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
eMudhra, Brotli, and the Long Tail of a Security Fix
- Published
- Record updated
Summary
Researchers recovered eight eMudhra intermediate CA private keys, which the source says were supposed to be 384-bit but fit in eight bits, so every possibility can be tried by counting to 255. eMudhra attributes the flaw to a key-generation ceremony in April 2025 and says the intermediates never issued customer certificates. Browsers blocked the certificates, while other clients needed a new bundle or verifier change.
Mitigation
Go fixed the verifier in versions 1.27.3 and 1.26.10, and applications must be rebuilt with the patched toolchain. Mozilla advises blocking the compromised intermediates where possible, and notes that removing trusting roots could break legitimate connections. Bun 1.4.4 updated its Brotli library, but executables built with bun build --compile need rebuilding.