Critical NSS Vulnerability Exposes Systems to Denial of Service Risks

Linuxsecurity

Critical NSS Vulnerability Exposes Systems to Denial of Service Risks

First seen 29 Jun 2026, 22:43 UTC • •72.0

Article Content

1 / 3

Browse articles

ThreatCluster •June 30, 2026 at 22:35 UTC

•NSS vulnerability allows denial of service or sensitive information exposure.
•Affected Ubuntu versions include 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS.
•Users are urged to update their systems to mitigate the risk.

A vulnerability in the Network Security Service (NSS) library has been discovered, which could allow attackers to crash the service or expose sensitive information through specially crafted input. This flaw, identified by Haruto Kimura, involves improper handling of PKCS#11 URI escape sequences. Affected systems include Ubuntu versions 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS. Users are advised to update their systems to mitigate the risk. The vulnerability could lead to denial of service attacks or information leaks, making it critical for administrators to act promptly. The issue has been documented in Ubuntu Security Notice USN-8481-1, and a standard system update will address the problem.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 101d ago How this analysis works

Timeline

2026-06-29

NSS vulnerability disclosed

Haruto Kimura reported a flaw in NSS affecting multiple Ubuntu versions, leading to potential crashes or data exposure.

2026-06-29

Security notice USN-8481-1 published

Ubuntu issued a security notice detailing the NSS vulnerability and recommended updates for affected systems.

More articles in this cluster (2)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Data Breach
DDoS

Organization (1)

Ubuntu

Weakness (1)

CWE-200 - Exposure of Sensitive Information

Relationships

Data Breach related to DDoS
Data Breach related to Ubuntu
Data Breach related to CWE-200 - Exposure of Sensitive Information

Following this threat?

Track Ubuntu in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…