CVE-2019-11719: Mozilla Firefox

High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days.

When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Affected products

• Mozilla Firefox: before 60.8.0 (fixed in 60.8.0); before 68.0 (fixed in 68.0)
• Mozilla Thunderbird: before 60.8.0 (fixed in 60.8.0)

Published 2019-07-23. Last modified 2026-06-17.