Architect's Tech Stack

Oct 23, 2026 · Information Security

Java CVE-2026-91403: eMudhra CA Private Keys (4,56,115) Break Trust Chain

A critical Java vulnerability (CVE-2026-91403, CVSS 9.1) stems from three eMudhra intermediate CA private keys with absurdly small values (4, 56, 115) on the P-384 curve, allowing instant private key recovery and forged certificates; browsers blocked them via preloaded revocation lists, but Java's JSSE defaults to skipping revocation checks, requiring JDK upgrades or manual blocked.certs updates and enabling revocation checking.