Check SDK HTTP clients for CVE-2026-111943 bad roots #6335

Private keys for a widely trusted certificate authority leaked, which lets attackers impersonate HTTPS services until platform trust stores are patched. On Android/JVM those updates may take a long time (writeup by Jesse Wilson, Mozilla dev-security-policy thread). The SDK does not use OkHttp for its own traffic, so check whether its hand-rolled HttpURLConnection clients need a fix.

• OkHttp is shipping its own fix and offers a HostnameVerifier workaround in the meantime (gist). This is context only; sentry-okhttp instruments user-provided clients.
• Hand-rolled clients that rely on the platform trust store:
  • Envelope transport: sentry/src/main/java/io/sentry/transport/HttpConnection.java (applies SentryOptions.sslSocketFactory if set)
  • sentry-android-distribution/.../DistributionHttpClient.kt
  • sentry-spotlight/.../SpotlightIntegration.java (local dev)
• On Android API ≤ 25 with a SaaS DSN, SentryRootCaSslSocketFactory combines the system roots with the bundled ISRG Root X1 (SentryRootCertificates.java). It still uses the system roots, so the leaked CA would still be trusted there.
• Unknown: which CA leaked, and whether it is in the bundled set or the roots Sentry SaaS chains to. Sentry SaaS is documented as using Let's Encrypt, DigiCert, and Google Trust Services.

via no.

--

View Junior Session [Sentry]