SUSE-SU-2026:5126-1
Security update for mozilla-nss
No scoreFix available
SUSE-SU-2026:5126-1 is a vulnerability with no CVSS score yet in mozilla-nss, published November 6, 2026. No source lists public exploit code. Fixed in mozilla-nss 3.125.1-58.152.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.125.1-58.152.1mozilla-nss +1 more
Description
This update for mozilla-nss fixes the following issue:
- remove compromised eMudhra Intermediates CA (bsc#1286261).
Changes for mozilla-nss:
- update to NSS 3.125.1 (bsc#1289144):
- bmo#2088196 - backport nssckbi 2.92.
- bmo#2082793 - Don't cache sessions when ECH was rejected.
- bmo#2082792 - Keep DTLS handshake messages whole in the send buffer.
- bmo#2082077 - Initialize sftk_MACCtx in sftk_MAC_Init.
- bmo#2082027 - reorder session context setup in sftk_doMACInit.
- bmo#2054723 - harden against integer overflows in lowpbe.c.
- bmo#2054697 - fix AES GCM parameter serialization in pk11_GetPBECryptoMechanism.
- bmo#2054695 - handle HMAC truncation when using PK11_Digest* APIs.
- bmo#2054616 - reject short ciphertexts in sec_pkcs5_rc2.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mozilla-nssSUSE:Linux Enterprise Server 12 SP5-LTSS | before 3.125.1-58.152.1 | 3.125.1-58.152.1 |
mozilla-nssSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | before 3.125.1-58.152.1 | 3.125.1-58.152.1 |
What each source reports
OSVNo score
Security update for mozilla-nss
This update for mozilla-nss fixes the following issue:
- remove compromised eMudhra Intermediates CA (bsc#1286261).
Changes for mozilla-nss:
- update to NSS 3.125.1 (bsc#1289144):
- bmo#2088196 - backport nssckbi 2.92.
- bmo#2082793 - Don't cache sessions when ECH was rejected.
- bmo#2082792 - Keep DTLS handshake messages whole in the send buffer.
- bmo#2082077 - Initialize sftk_MACCtx in sftk_MAC_Init.
- bmo#2082027 - reorder session context setup in sftk_doMACInit.
- bmo#2054723 - harden against integer overflows in lowpbe.c.
- bmo#2054697 - fix AES GCM parameter serialization in pk11_GetPBECryptoMechanism.
- bmo#2054695 - handle HMAC truncation when using PK11_Digest* APIs.
- bmo#2054616 - reject short ciphertexts in sec_pkcs5_rc2.
- Record
SUSE-SU-2026:5126-1- Updated
- 2026-11-07
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.