Cyber ·
CVE-2026-113812: Mozilla::CA package before 20261020 includes a compromised root
CPAN Security Group advisory on the Perl Mozilla-CA distribution. Versions before 20261020 ship a CA certificate bundle with a root linked to compromised intermediates. The text was posted to the oss-sec feed on 20 October.
The advisory identifies the issue as CVE-2026-113812 and affects the Mozilla-CA distribution used with Perl, in all versions before 20261020. According to the text, older versions ship a certificate authority bundle in which one root certificate is linked to compromised intermediates. The publication names the CPAN Security Group as author and is dated 20 October 2026. This material is an automatic, truncated translation of the oss-sec feed, so further technical details, such as the exact list of affected certificates, should be confirmed in the original advisory, the MetaCPAN metadata and the project repository.
For the reader, the relevance is checking whether your systems or scripts depend on this Perl library and, if so, updating to version 20261020 or later. Rota Nacional does not fix third-party dependencies or assess the trust of certificate chains in other software. If you use AI to study the advisory, do not paste credentials, keys or internal server names: the platform's detection covers CPF, CNPJ, e-mail, phone and person names, not technical secrets.