Description
In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | NSS | unspecified – < 3.44 | 3.44 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nss | 2:3.45-1 | — |
| Debian 13 | nss | 2:3.45-1 | — |
| Debian 12 | nss | 2:3.45-1 | — |
| Debian 10 | nss | 2:3.42.1-1+deb10u2 | DSA-4579-1 |
| Debian 9 | nss | 2:3.26.2-1.1+deb9u2 | DLA-2388-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | nss | 2:3.26-1+debu8u8 | DLA-2015-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | nss | 2:3.35-2ubuntu2.6 | USN-4215-1 |
| Ubuntu 16.04 LTS | nss | 2:3.28.4-0ubuntu0.16.04.9 | USN-4215-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | nss | 2:3.28.4-0ubuntu0.14.04.5+esm3 | USN-4215-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nspr +1 | 4.21.0-2.el8_0 | RHSA-2019:1951 |
| RHEL 8 | nss +9 | 3.44.0-7.el8_0 | RHSA-2019:1951 |
| RHEL 7 | nspr +1 | 4.21.0-1.el7 | RHSA-2019:2237 |
| RHEL 7 | nss +4 | 3.44.0-4.el7 | RHSA-2019:2237 |
| RHEL 7 | nss-softokn +3 | 3.44.0-5.el7 | RHSA-2019:2237 |
| RHEL 7 | nss-util +1 | 3.44.0-3.el7 | RHSA-2019:2237 |
| RHEL 6 | nspr +1 | 4.21.0-1.el6_10 | RHEA-2019:3280 |
| RHEL 6 | nss +4 | 3.44.0-7.el6_10 | RHEA-2019:3280 |
| RHEL 6 | nss-softokn +3 | 3.44.0-5.el6_10 | RHEA-2019:3280 |
| RHEL 6 | nss-util +1 | 3.44.0-1.el6_10 | RHEA-2019:3280 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7.6 EUS | nss +4 | 3.36.0-9.el7_6 | RHSA-2021:0876 |
| RHEL 7.6 EUS | nss-softokn +3 | 3.36.0-7.el7_6 | RHSA-2021:0876 |
Advisories 9
- RHSA-2019:2237 Red Hat Security Advisory: nss, nss-softokn, nss-util, and nspr security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- USN-4215-1 nss vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- RHSA-2021:0876 Red Hat Security Advisory: nss and nss-softokn security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2019:1951 Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHEA-2019:3280 Red Hat Enhancement Advisory: nss, nss-softokn, nss-util and nspr bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-4579-1 nss - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2015-1 nss - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2388-1 nss - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ICSA-21-040-04 Siemens RUGGEDCOM ROX II CISA ICS & IT advisories · Feb 9, 2021