[runningcode]

📜 Description

Rejects TLS servers that present one of the eight leaked eMudhra intermediate certificates (CVE-2026-111943). The check covers the two places where the SDK opens its own HTTPS connections: the envelope transport (HttpConnection) and the Android distribution update check (DistributionHttpClient).

The new internal DistrustedCertificates.verify(connection) runs right after connect(). It hashes the public key of every certificate the server presented. On a match, it disconnects and throws SSLPeerUnverifiedException. At that point the TLS handshake is done, but no part of the request has been written yet, both on the JVM and on Android's built-in HttpsURLConnection. A blocked envelope fails with an IOException, so it stays in the offline cache and is retried later.

💡 Motivation and Context

The private keys of eight eMudhra intermediates can be recovered from their certificates. Sectigo's AAA Certificate Services root also cross-signed each of these keys, and that root is trusted on every Android version. So removing the eMudhra root from trust stores isn't enough, and devices that don't get CA or Conscrypt updates keep trusting forged certificates. Browsers are protected by Certificate Transparency and their own revocation lists, but HttpsURLConnection has neither.

OkHttp (writeup) and Go 1.26.10 / 1.27.3 (commit) ship the same mitigation. OkHttp's workaround uses a HostnameVerifier, but that doesn't work here: the JVM's HttpsURLConnection only calls a custom verifier when its own hostname check fails. That's why this checks the server certificates after connect() instead.

The eight SPKI hashes match the OkHttp and Go lists. They were also re-computed from the 16 certificates in the disclosure's impacted-intermediates.json. Background: Mozilla dev-security-policy thread.

Fixes JAVA-783

💚 How did you test it?

Unit tests in DistrustedCertificatesTest and HttpConnectionTest use the real EM DV TLS CA - G3B certificate cross-signed by AAA Certificate Services. DistributionHttpClient creates its own connection with no way to inject a mock, so it relies on the tests of the shared check.

📝 Checklist

• I added GH Issue ID & Linear ID
• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• Review from the native team if needed.
• No breaking change or entry added to the changelog.
• No breaking change for hybrid SDKs or communicated to hybrid SDKs.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.

🔮 Next steps

Out of scope: SpotlightIntegration only talks to a local server, and the HTTP client integrations (sentry-okhttp, Apache, OpenFeign, Ktor, Spring) instrument the app's own clients, which the app has to update itself.

🤖 Generated with Claude Code

[linear-code]

JAVA-783

[github-actions]

🚨 Detected changes in high risk code 🚨

High-risk code has higher potential to break the SDK and may be hard to test. To prevent severe bugs, apply the rollout process for releasing such changes and be extra careful when changing and reviewing these files:

• sentry/src/main/java/io/sentry/transport/HttpConnection.java

[github-actions]

🚨 Detected changes in high risk code 🚨

High-risk code has higher potential to break the SDK and may be hard to test. To prevent severe bugs, apply the rollout process for releasing such changes and be extra careful when changing and reviewing these files:

• sentry/src/main/java/io/sentry/transport/HttpConnection.java

[sentry]

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.61.0 (1)	release

⚙️ sentry-android Build Distribution Settings

[github-actions]

🚨 Detected changes in high risk code 🚨

High-risk code has higher potential to break the SDK and may be hard to test. To prevent severe bugs, apply the rollout process for releasing such changes and be extra careful when changing and reviewing these files:

• sentry/src/main/java/io/sentry/transport/HttpConnection.java