SaxonC is affected
by the eMudhra CA compromise, because it contains its own
CA Cert bundle, separate from the operating system bundle and language-specific
mechanisms like Python’s certifi.
SaxonC is built with GraalVM, against which Oracle have issued the CVE-2026-91403 and CVE-2026-114820 advisories.
These relate to the compromised eMudhra certificates. The 12.10.1 and 13.1.1 releases adopt the mitigation recommended in CVE-2026-114820: they have been rebuilt with updates that remove the set of impacted root CA certificates related to eMudhra.
Users should upgrade from vulnerable versions immediately.
Vulnerable versions are SaxonC 12.6 to, and including, 12.10, 13.0, and 13.1. Versions 12.5 and prior are not vulnerable because they predate the compromised certificates.
If you cannot upgrade, and your workflows should not access remote
URIs (through <xsl:import>, fn:doc(),
or other mechanisms), then you can
prevent HTTP/HTTPS resource access by restricting Saxon with the
ALLOWED_PROTOCOLS configuration option. See the documentation
for configuration features.
If you must access remote HTTPS URIs, then no mitigation is possible, and you should upgrade as soon as possible.
Note that this vulnerability does not apply to the Saxon Java or C# products, only SaxonC (C, C++, Python, and PHP) releases are affected. Java and C# users should ensure that they’re using Java and C# runtimes that have been patched to mitigate the vulnerability.