[austin-barrington]

CVE-2026-111943: eight eMudhra intermediate CA keys under emSign ECC Root CA - G3 can be recovered trivially, so anyone can forge a certificate that clients trusting that root accept.

Exposure (every release up to 0.9.2-beta):

• Server, proxy and CLI trust the root list compiled into webpki-roots (reqwest's rustls-tls), not the OS store. 1.0.9 has the root.
  • The CLI is the exposed one: it connects over HTTPS to any endpoint.
  • The server and proxy only make plain-HTTP peer and backend calls.
• Images ship Debian ca-certificates 20250419~deb12u1, which has the root. The binaries don't consult the OS store for their own connections, but chDB's url()/s3() (reachable through /api/v1/chdb) would.

Changes:

• webpki-roots 1.0.9 -> 1.0.10 and rustls-webpki 0.103.13 -> 0.103.16, in the workspace and the Rust client's lockfile. aws-lc-rs/aws-lc-sys move with rustls-webpki.
• Every runtime image stage now fails the build if the CA bundle still holds the root. Bookworm's 20250419~deb12u2 drops it (checked). Changing that step also stops the release build's layer cache (cache-from: type=gha) from reusing the old apt layer. Checked that the guard passes on a fresh bookworm and fails on the 0.9.2-beta image's bundle.
• Other cargo audit findings, fixed by compatible updates:
  • rustls 0.23.43 -> 0.23.46 (RUSTSEC-2026-0285, -0346, -0348, -0349)
  • h2 0.4.15 -> 0.4.20 (RUSTSEC-2026-0258)
  • quinn-proto 0.11.16 -> 0.11.19 (RUSTSEC-2026-0338 to -0342)
• Second commit: the lockfile follows Download libchdb with reqwest 0.12 over rustls chdb-rust#3, which moves its build script to reqwest 0.12 over rustls. That drops h2 0.3.27 and OpenSSL from the build.

Merge order: hyperbyte-cloud/chdb-rust#3 first, then this. The release image builds with --locked against chdb-rust main.

After this, cargo audit reports only rkyv 0.7.46 (RUSTSEC-2026-0235), which is in the lockfile but not compiled into anything. The CI-equivalent run (libchdb 26.9.0, -D warnings) passes.

For the release notes:

• Rebuild without cache.
• Users of the Rust client should run cargo update.
• Go, Node and Python client users need a runtime with the fix: Go 1.27.3 / 1.26.10; Node 26.12.1 / 24.22.1 / 22.23.4; Python certifi 2026.10.19.

[cursor]

PR Summary

Medium Risk
TLS and CA trust changes affect HTTPS clients (especially the CLI and chDB URL/S3 paths); image builds will fail until ca-certificates includes the fix.

Overview
Addresses CVE-2026-111943 by refreshing TLS trust material and hardening release images against shipping the compromised emSign ECC Root CA - G3.

Lockfiles (Cargo.lock, clients/rust/Cargo.lock): bumps webpki-roots (1.0.9 → 1.0.10), rustls-webpki, rustls, aws-lc-rs/aws-lc-sys, h2 (0.4.20), and quinn-proto (0.11.19) for related cargo audit advisories. The workspace graph also drops the older reqwest 0.11 / hyper 0.14 / OpenSSL build path as chdb-rust moves to reqwest 0.12 over rustls.

Runtime Docker stages (Dockerfile, Dockerfile.runtime, Dockerfile.proxy-runtime, hyperbytedb-proxy/Dockerfile): after apt install ca-certificates, the build fails if /etc/ssl/certs/emSign_ECC_Root_CA_-_G3.pem still exists—so stale cached apt layers cannot ship a pre-fix Debian bundle.

^{Reviewed by Cursor Bugbot for commit 8ca0027. Configure here.}

[cursor]

Approved. Cursor Bugbot completed successfully with no findings that need human review, and no approval policy requires additional review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}