CVE-2021-40855: Europa Technical Specifications For Digital Covid Certificates

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

The EU Technical Specifications for Digital COVID Certificates before 1.1 mishandle certificate governance. A non-production public key certificate could have been used in production.

Affected products

• Europa Technical Specifications For Digital Covid Certificates: before 1.1 (fixed in 1.1)

Published 2022-01-21. Last modified 2026-06-17.