CVE-2009-2409

no score yetEPSS 4.3%

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

EPSS: 4.3% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE: CWE-295
Published: 2009-07-30
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

gnu:gnutls
mozilla:network_security_services
openssl:openssl

References

http://java.sun.com/j2se/1.5.0/ReleaseNotes.html
http://java.sun.com/javase/6/webnotes/6u17.html
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
http://secunia.com/advisories/36139
http://secunia.com/advisories/36157

Check your stack JSON