eMudhra/emSign CA compromise (October 2026): what Cloud SDK Java Libraries developers need to do

Open
  • Is something wrong?
#33,811 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
5/100
Issue type
Documentation
Clarity
Needs clarification
Activity status
Active
Tech stack
java
Domain
security

Research direction

This is a locked security advisory announcement with no code change requested and no files named in the repository. The payload points to GHSA-m4gc-hcgx-wmc7 and bulletin GCP-2026-075 for the details. A newcomer cannot complete it, so look for a separate open issue that asks for a concrete change.

Written by the indexing model from the issue text.

Description

Summary

Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.

The following packages and trust stores are affected

  • com.google.api-client:google-api-client earlier than 2.9.2, when the HTTP transport is created with GoogleNetHttpTransport.newTrustedTransport(). Versions earlier than 2.9.0 always use a bundled trust store that includes AAA Certificate Services; versions 2.9.0 and 2.9.1 use it when the JDK trust store cannot be loaded.
  • Google API service library packages (com.google.apis:google-api-services-*) with a version suffix earlier than -2.9.2, which depend on an affected google-api-client.
  • The JDK trust store (cacerts), used by all other Google client transports, and the Windows certificate store on Windows.

You can take the following actions to resolve these issues

  • Upgrade google-api-client to 2.9.2 or later, or com.google.cloud:libraries-bom to 26.91.0 or later.
  • If your build declares a service library without google-api-client, upgrade the service library to a release whose version ends in -2.9.2 or later (for example google-api-services-bigquery:v2-rev20260922-2.9.2), or declare com.google.api-client:google-api-client:2.9.2 directly.
  • If you use Spring Framework on Google Cloud, upgrade to the current patch release of your line: 8.3.1, 7.5.2, 6.5.12, 3.9.19 or later; these import libraries-bom 26.91.0.
  • Apply your JDK vendor's security update.
  • On Windows, apply the Windows root certificate update.

Advisory: GHSA-m4gc-hcgx-wmc7 (google-api-client).

Google Cloud Security Bulletin: GCP-2026-075.

This issue is locked. Please open a new issue for questions.

Dominant language
Java
Stars
731
Forks
402
Avg merge
5h 43m
Merged PRs (30d)
959

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from googleapis/google-api-java-client-services

All issues in googleapis/google-api-java-client-services

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.