eMudhra Python mitigations

Friday, 23rd October 2026

The eMudhra problem is quite bad. Any system that depends on TLS/SSL and makes network requests is potentially vulnerable. eMudhra was added in spring 2019, so most versions of until 2026-10-20 have problems.

Examples of things in need of attention:

any Linux machines with old cron jobs/services making network requests
old Docker images deployed somewhere
CI package caches
Python venvs with the certifi dependency or with the pip dependency (which vendors its own certificates)

For Python specifically, you’ll need to update pip and uv, since they vendor their own certs and those are exposed.

 1# Update uv
 2brew update && brew upgrade uv
 3# or
 4sudo pacman -Sy uv
 5# or
 6uv self update
 7# Upgrade all Python installations which now ship a patched pip
 8uv python upgrade
 9
10# Updating pip
11python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"

More useful scripts and information here: Information for Python users regarding eMudhra / emSign CA certificate security incident - Announcements - Discussions on Python.org.

Any vulnerable venv needs to upgrade

1# Upgrade certifi and pip
2uv pip install -U certifi pip
3# If a uv.lock is present, it needs an explicit version bump
4uv lock --upgrade-package certifi

This script will find and print all Python venvs on your machine (under your user) and print the certifi version in that venv

1find ~ /opt /usr/lib -xdev -type f -path '*certifi/__init__.py' 2>/dev/null |
2while read f; do
3  v=$(grep -m1 -oP '__version__ = "\K[^"]+' "$f")
4  echo "$v  ${f%/__init__.py}"
5done | sort

2:37pm