Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

• Debian:12 firefox-esr102.11.0esr-1, 102.12.0esr-1, 102.12.0esr-1~deb10u1
• Debian:13 firefox-esr128.13.0esr-1, 128.14.0esr-1, 128.14.0esr-1~deb11u1
• Debian:14 firefox-esr128.13.0esr-1, 128.14.0esr-1, 128.14.0esr-1~deb11u1

How to fix CVE-2026-113470

• Recommended remediation

  A patch or advisory reference is linked. Open the original publisher for availability by product version.

• Official advisories

  • BSI CERT-Bund · wid.cert-bund.de
  • CVE.org · cve.org
  • FIRST EPSS · first.org
  • Mozilla Security Advisories · mozilla.org
  • NIST NVD · nvd.nist.gov
  • OpenSSF OSV / OSV Scanner · osv.dev

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Technology hubs

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 20, 2026 · NIST NVD

   Detected

   Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was f

2. Oct 20, 2026 · NIST NVD

   Updated

   Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was f

3. Oct 20, 2026 · OpenSSF OSV / OSV Scanner

   Updated

   Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was f

4. Oct 20, 2026 · NIST NVD

   Updated

   Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was f

5. Oct 21, 2026 · NIST NVD

   Updated

   Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was f

6. Oct 21, 2026 · NIST NVD

   Updated

   Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.

Sources

• BSI CERT-BundGovernment advisoryCVE-2026-113470

  Mozilla Produkte (Thunderbird, Firefox ESR und Firefox): Mehrere Schwachstellen

  wid.cert-bund.de
• CVE.orgVulnerability recordCVE-2026-113470

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-113470

  30-day exploitation probability 0.34%

  first.org
• Mozilla Security AdvisoriesVendor advisoryCVE-2026-113470

  Security Vulnerabilities fixed in Firefox for Android 158.0.2 — Mozilla

  mozilla.org
• NIST NVDVulnerability recordCVE-2026-113470

  Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.

  nvd.nist.gov
• OpenSSF OSV / OSV ScannerPackage advisoryDEBIAN-CVE-2026-113470
  osv.dev

References

• Reference · openwall.com
• Reference · bugzilla.mozilla.org
• Reference · bugzilla.mozilla.org
• Reference · lists.debian.org
• ADVISORY · security-tracker.debian.org
• Reference · mozilla.org
• Reference · mozilla.org
• Reference · mozilla.org
• Reference · mozilla.org
• Reference · mozilla.org
• Reference · mozilla.org

Freshness

Last verified in this catalog Oct 23, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.