Oracle has announced that GraalVM, along with the JDK, have been shipping with a default trust store that includes the compromised eMudhra certificates. The native-image feature we use to build SaxonC integrates that trust store into the SaxonC library, so recent versions of SaxonC (C, C++, Python, and PHP) have also shipped with the compromised certificates.
The compromised trust store applies to SaxonC releases starting with 12.6 up to and including 13.1. It does not affect SaxonC 12.5 or earlier releases and it does not apply to our Java or C# products. Users should take mitigating steps to ensure that they’re using Java and C# runtimes that have been patched.
Loading a different trust store in the host language runtime, for example, with the Python Requests library, or simply updating the operating system Certificate Authorities bundle is insufficient to mitigate the problem.
We are working to build a patch release that removes the eMudhra compromised certificates from the default trust store in SaxonC.