{
  "cveId": "CVE-2026-113470",
  "url": "https://patchblox.com/security/cve/CVE-2026-113470",
  "summary": "CVE-2026-113470 is fixed in 41 products on 1 platform, first by DEBIAN-CVE-2026-113470, released October 21, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "firefox-esr: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component",
  "description": "Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.",
  "published": "2026-10-20T00:00:00Z",
  "severity": "medium",
  "cvss": 8.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
  "epss": 0.0046,
  "epssPercentile": 0.40103,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "MozillaFirefox",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "153.5.1-160000.1.1",
      "fix": "OPENSUSE-SU-2026:22159-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22159-1",
      "released": "2026-11-07T00:47:19Z"
    },
    {
      "platform": "linux",
      "product": "ca-certificates",
      "release": "amzn 2023",
      "fixedVersion": "2025.2.76-1.0.amzn2023.0.4",
      "fix": "ALAS2023-2026-3306",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3306",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "ca-certificates",
      "release": "ol 10",
      "fixedVersion": "0:2025.2.80_v9.0.305-102.0.1.el10_2",
      "fix": "ELSA-2026-500451",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500451",
      "released": "2026-11-07T00:59:15Z"
    },
    {
      "platform": "linux",
      "product": "ca-certificates",
      "release": "ol 8",
      "fixedVersion": "0:2025.2.80_v9.0.304-80.2.0.1.el8_10",
      "fix": "ELSA-2026-500449",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500449",
      "released": "2026-11-07T00:48:28Z"
    },
    {
      "platform": "linux",
      "product": "ca-certificates",
      "release": "ol 9",
      "fixedVersion": "0:2025.2.80_v9.0.305-91.0.1.el9",
      "fix": "ELSA-2026-500450",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-500450",
      "released": "2026-11-07T00:52:27Z"
    },
    {
      "platform": "linux",
      "product": "firefox",
      "release": "amzn 2023",
      "fixedVersion": "153.5.1-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3329",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3329",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "firefox-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "153.5.1-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3329",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3329",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "firefox-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "153.5.1-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3329",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3329",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "firefox-esr",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "153.5.1esr-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-113470",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-113470",
      "released": "2026-10-21T16:54:52Z"
    },
    {
      "platform": "linux",
      "product": "firefox-esr",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "153.5.1esr-1~deb13u1",
      "fix": "DEBIAN-CVE-2026-113470",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-113470",
      "released": "2026-10-21T16:54:52Z"
    },
    {
      "platform": "linux",
      "product": "firefox-esr",
      "release": "Debian 14",
      "fixedVersion": "153.5.1esr-1",
      "fix": "DEBIAN-CVE-2026-113470",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-113470",
      "released": "2026-10-21T16:54:52Z"
    },
    {
      "platform": "linux",
      "product": "java-1.8.0-amazon-corretto",
      "release": "amzn 2023",
      "fixedVersion": "1:1.8.0_512.b08-1.amzn2023",
      "fix": "ALAS2023-2026-3315",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3315",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-1.8.0-amazon-corretto-debugsymbols",
      "release": "amzn 2023",
      "fixedVersion": "1:1.8.0_512.b08-1.amzn2023",
      "fix": "ALAS2023-2026-3315",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3315",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-1.8.0-amazon-corretto-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:1.8.0_512.b08-1.amzn2023",
      "fix": "ALAS2023-2026-3315",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3315",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-11-amazon-corretto",
      "release": "amzn 2023",
      "fixedVersion": "1:11.0.33.0.9-1.amzn2023",
      "fix": "ALAS2023-2026-3317",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3317",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-11-amazon-corretto-debugsymbols",
      "release": "amzn 2023",
      "fixedVersion": "1:11.0.33.0.9-1.amzn2023",
      "fix": "ALAS2023-2026-3317",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3317",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-11-amazon-corretto-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:11.0.33.0.9-1.amzn2023",
      "fix": "ALAS2023-2026-3317",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3317",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-11-amazon-corretto-headless",
      "release": "amzn 2023",
      "fixedVersion": "1:11.0.33.0.9-1.amzn2023",
      "fix": "ALAS2023-2026-3317",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3317",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-11-amazon-corretto-javadoc",
      "release": "amzn 2023",
      "fixedVersion": "1:11.0.33.0.9-1.amzn2023",
      "fix": "ALAS2023-2026-3317",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3317",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-11-amazon-corretto-jmods",
      "release": "amzn 2023",
      "fixedVersion": "1:11.0.33.0.9-1.amzn2023",
      "fix": "ALAS2023-2026-3317",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3317",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-17-amazon-corretto",
      "release": "amzn 2023",
      "fixedVersion": "1:17.0.21.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3318",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3318",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-17-amazon-corretto-debugsymbols",
      "release": "amzn 2023",
      "fixedVersion": "1:17.0.21.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3318",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3318",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-17-amazon-corretto-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:17.0.21.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3318",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3318",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-17-amazon-corretto-headless",
      "release": "amzn 2023",
      "fixedVersion": "1:17.0.21.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3318",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3318",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-17-amazon-corretto-javadoc",
      "release": "amzn 2023",
      "fixedVersion": "1:17.0.21.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3318",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3318",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-17-amazon-corretto-jmods",
      "release": "amzn 2023",
      "fixedVersion": "1:17.0.21.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3318",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3318",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-21-amazon-corretto",
      "release": "amzn 2023",
      "fixedVersion": "1:21.0.13.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3319",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3319",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-21-amazon-corretto-debugsymbols",
      "release": "amzn 2023",
      "fixedVersion": "1:21.0.13.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3319",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3319",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-21-amazon-corretto-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:21.0.13.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3319",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3319",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-21-amazon-corretto-headless",
      "release": "amzn 2023",
      "fixedVersion": "1:21.0.13.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3319",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3319",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-21-amazon-corretto-javadoc",
      "release": "amzn 2023",
      "fixedVersion": "1:21.0.13.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3319",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3319",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-21-amazon-corretto-jmods",
      "release": "amzn 2023",
      "fixedVersion": "1:21.0.13.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3319",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3319",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-25-amazon-corretto",
      "release": "amzn 2023",
      "fixedVersion": "1:25.0.5.0.9-1.amzn2023.1",
      "fix": "ALAS2023-2026-3320",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3320",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-25-amazon-corretto-debugsymbols",
      "release": "amzn 2023",
      "fixedVersion": "1:25.0.5.0.9-1.amzn2023.1",
      "fix": "ALAS2023-2026-3320",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3320",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-25-amazon-corretto-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:25.0.5.0.9-1.amzn2023.1",
      "fix": "ALAS2023-2026-3320",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3320",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-25-amazon-corretto-headless",
      "release": "amzn 2023",
      "fixedVersion": "1:25.0.5.0.9-1.amzn2023.1",
      "fix": "ALAS2023-2026-3320",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3320",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-25-amazon-corretto-javadoc",
      "release": "amzn 2023",
      "fixedVersion": "1:25.0.5.0.9-1.amzn2023.1",
      "fix": "ALAS2023-2026-3320",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3320",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-25-amazon-corretto-jmods",
      "release": "amzn 2023",
      "fixedVersion": "1:25.0.5.0.9-1.amzn2023.1",
      "fix": "ALAS2023-2026-3320",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3320",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-27-amazon-corretto",
      "release": "amzn 2023",
      "fixedVersion": "1:27.0.1.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3316",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3316",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-27-amazon-corretto-debugsymbols",
      "release": "amzn 2023",
      "fixedVersion": "1:27.0.1.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3316",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3316",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-27-amazon-corretto-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:27.0.1.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3316",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3316",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-27-amazon-corretto-headless",
      "release": "amzn 2023",
      "fixedVersion": "1:27.0.1.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3316",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3316",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-27-amazon-corretto-javadoc",
      "release": "amzn 2023",
      "fixedVersion": "1:27.0.1.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3316",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3316",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "java-27-amazon-corretto-jmods",
      "release": "amzn 2023",
      "fixedVersion": "1:27.0.1.0.10-1.amzn2023.1",
      "fix": "ALAS2023-2026-3316",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3316",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "mozilla-nss",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "3.125-160000.3.1",
      "fix": "OPENSUSE-SU-2026:22159-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22159-1",
      "released": "2026-11-07T00:47:19Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1:153.5.1esr-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-113470",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-113470",
      "released": "2026-10-21T16:54:52Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1:153.5.1esr-1~deb13u1",
      "fix": "DEBIAN-CVE-2026-113470",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-113470",
      "released": "2026-10-21T16:54:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T13:56:55Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}