CLEANSTART-2024-SW80584 When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library

🗓️ 31 Oct 2026 08:51:06Reported by GoogleType

osv_cleanstart🔗 osv.dev👁 4 Views

Out-of-bounds read in the Network Security Services (NSS) library in firefox-esr.

Reporter	Title	Published	Views	Family All 184
FreeBSD	mozilla -- multiple vulnerabilities	9 Jul 201900:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	15 Apr 202221:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	29 Apr 202502:26	–	ibm
IBM Security Bulletins	Security Bulletin: Synthetic Playback Agent 8.1.4 is affected by multiple vulnerabilities	16 Sep 201909:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Appliance is affected by multiple nss and nspr vulnerabilities	21 Jan 202109:32	–	ibm
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 68.0.1-alt1	19 Jul 201900:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 60.8.0-alt1	9 Jul 201900:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 60.8.0-alt1	10 Jul 201900:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 68.0-alt1	29 Aug 201900:00	–	altlinux
Tenable Nessus	Amazon Linux 2 : nspr, nss-softokn, nss-util, nss (ALAS-2020-1559)	11 Nov 202000:00	–	nessus

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2024/CLEANSTART-2024-SW80584.json
osv	www.osv.dev/vulnerability/CVE-2019-11719
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-11719

31 Oct 2026 16:02Current

7.9High risk

Vulners AI Score7.9

CVSS 37.5

EPSS0.02292

firefox-esr Network Security Services NSS out-of-bounds read curve25519 PKCS#8