Red Hat CVE-2026-4727

Remote unauthenticated attacker sends crafted network traffic to Firefox < 149. No user interaction required. Affects all default Firefox installations; no special configuration needed. Attack causes denial-of-service in NSS Libraries component.

Risk assessment is constrained by missing CVSS score, CVSS vector, and EPSS data, limiting quantitative evaluation. However, several mitigating factors reduce real-world priority: the vulnerability is not listed in CISA's KEV catalog, indicating no known active exploitation in the wild; no public proof-of-concept has surfaced; and the denial-of-service impact is less severe than remote code execution. The attack vector is likely network-based (given it affects TLS/SSL in a browser context), but the complexity and privilege requirements remain unknown without the full CVSS vector. The primary risk lies in availability—an attacker could disrupt Firefox users' browsing or cause application crashes. Organizations should prioritize patching to Firefox 149 as part of standard update cycles rather than treating this as an emergency critical issue. The library-level nature suggests the vulnerability may also affect other NSS consumers (e.g., Thunderbird, Chrome), warranting ecosystem-wide monitoring.

An attacker could craft a malicious TLS handshake or send specially constructed cryptographic payloads to a Firefox user browsing a compromised or attacker-controlled website. Upon processing the malicious input through the NSS Libraries component, the vulnerability triggers resource exhaustion or an algorithmic flaw, causing Firefox to consume excessive CPU, memory, or become unresponsive, resulting in a denial-of-service condition for the user. Because the attack likely occurs during the TLS negotiation phase, the user's browser would hang or crash before completing the connection, disrupting normal browsing activity. No widely available proof-of-concept has been released, reducing the likelihood of mass exploitation but not eliminating the risk of targeted attacks against specific users or organizations.