Python certifi Critical Patch Strips Root Certificates from Trust Store in Oct 2026 Update

The Python certifi package released version 2026.10.19 on October 20, 2026, to address a critical security vulnerability. This update removes root certificates from the package's trusted certificate authority store.

What happened

Seth Larson announced the critical security update for certifi on October 20, 2026, via the security-announce mailing list. The advisory identifies the issue as affecting the certifi package, which provides Mozilla's curated bundle of root certificates for Python applications. Version 2026.10.19 specifically removes root certificates from this bundle.

The oss-security mailing list published the advisory under the identifier GHSA-6q48-6c7w-9gw2. The update was posted by Alan Coopersmith on October 20, 2026, forwarding the original message from Seth Larson. The advisory text confirms that the new version removes root certificates to mitigate the critical severity risk.

Why it matters

Security teams using Python libraries that depend on certifi must evaluate their exposure to this change. The removal of root certificates alters the trust chain for applications relying on this package for TLS verification. Systems that have not updated to version 2026.10.19 continue to trust the removed root certificates, which the advisory identifies as a critical vulnerability.

The critical severity rating indicates a high risk associated with the presence of these certificates. Applications that perform HTTPS requests using certifi for certificate validation are directly affected by this change. Teams need to ensure their environments are updated to the patched version to align with the updated trust store and eliminate the identified critical vulnerability.

What to watch

• Monitor package manager logs for successful installation of certifi version 2026.10.19.
• Check for any application failures related to TLS certificate validation after the update.
• Verify that downstream dependencies are compatible with the updated certifi version.
• Review internal security policies regarding root certificate trust and update procedures.

Signals worth monitoring

Teams usually detect trust store changes by reviewing package update logs and certificate validation errors. Check whether applications report unexpected TLS handshake failures after updating certifi. Monitor for alerts indicating connections to services using certificates signed by the removed authority. Verify that security tools correctly interpret the updated trust bundle. Ensure that monitoring systems capture the specific version change to confirm remediation. Look for any anomalies in certificate chain validation logs that might indicate residual trust issues.

What to do and how to stay safe: certifi

• Update certifi to version 2026.10.19 in all Python environments.
• Test application TLS connections to ensure compatibility with the new trust store.
• Review dependent packages for compatibility with the updated certifi version.
• Monitor logs for certificate validation errors after the update is deployed.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this certifi vulnerability?

The source material does not provide a CVE ID for this vulnerability.

Which root certificates were removed in the certifi update?

The source material states that root certificates were removed but does not specify which ones.

When was the certifi security update released?

The update was released on October 20, 2026.