NSS 3.124 Release

--000000000000fdd3e10651dc8f5f
Content-Type: text/plain; charset="UTF-8"

Network Security Services (NSS) 3.124 was released on 15 May 2026.

The HG tag is NSS_3_124_RTM. This version of NSS requires NSPR 4.38.2 or
newer. The latest version of NSPR is 4.39.

NSS 3.124 source distributions are available on ftp.mozilla.org for secure
HTTPS download:

<https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_124_RTM/src/>

Changes:
    Bug 2032562 - Add test for PKCS7 digest array alignment.
    Bug 2030093 - Add test for rejection of excessively large ASN.1
SEQUENCE OF in quickder.
    Bug 2030994 - Add test for CMS content size validation.
    Bug 2030995 - Add regression tests for DSAU signature decoding.
    Bug 2031030 - Add test for S/MIME profile lookup on temp certs.
    Bug 2031343 - Test case for post-handshake auth and many certificate
requests.
    Bug 2019233 - Add test for intra-arena ASan redzones.
    Bug 2033058 - update nss_status flags one at a time.
    Bug 2029803 - add defensive info->len check in PK11_HPKE_SetupS and
PK11_HPKE_SetupR.
    Bug 2029403 - avoid PORT_Strdup in ssl_DecodeResumptionToken.
    Bug 2020596 - add runtime check on decoded resumption token session id.
    Bug 2035882 - improve mach try error handling.
    Bug 2030798 - clang format.
    Bug 2030798 - add comprehensive SECItem and SECItemArray tests.
    Bug 2033058 - add bugzilla_cf_status_nss.py script.
    Bug 2033057 - regenerate some recent release notes.
    Bug 2033057 - fix bug list output by release note and email scripts.
    Bug 2031190 - test removal from trust domain email cache.
    Bug 2033208 - fix "testing if key corruption is detected in attribute"
failures with sqlite-3.53.0.
    Bug 2035348 - build sqlite3 shell for Windows CI runners.
    Bug 2030366 - avoid race with module unloading in
NSSTrustDomain_FindTokensByURI.
    Bug 2030192 - add ImportEd25519WithNonEmptyAlgorithmParams test.
    Bug 2034258 - add CLAUDE.md and .mcp.json.
    Bug 2034244 - add a mach try command.
    Bug 2031042 - remove dead condition in
sec_asn1d_check_and_subtract_length.
    Bug 2030374 - avoid integer truncation in nssCKObject_GetAttributes.
    Bug 2030564 - add defensive input validation to
sftk_compute_ANSI_X9_63_kdf.
    Bug 2029765 - avoid refcount over-release in nssTokenObjectCache error
path [@ nssToken_Destroy].
    Bug 2029883 - sdb: enforce that metaData's id key is unique when
reading.
    Bug 2023478 - improve handling of escape sequences in
pk11uri_ParseAttributes.
    Bug 2030570 - use correct data for ID comparison in
transfer_uri_certs_to_collection.
    Bug 2030573 - fix truncation of ulValueLen in sdb_FindObjectsInit.
    Bug 2033783 - reject DTLS 1.3 Server Hello after HVR without capping
ss->vrange.max.
    Bug 2034157 - set previous-nss-release for abicheck.
    Bug 2032389 - Skip `PR_Sleep` yield for non-blocking sockets in
`ssl3_SendApplicationData`.
    Bug 2033650 - consistently protect PK11SlotInfo::maxKeyCount with
freeListLock.
    Bug 2030985 - Remove CRMF from testing and manifests.
    Bug 2026711 - Remove unused RSA blind signature implementation from
freebl.

NSS 3.124 shared libraries are backwards-compatible with all older NSS 3.x
shared libraries. A program linked with older NSS 3.x shared libraries will
work with this new version of the shared libraries without recompiling or
relinking. Furthermore, applications that restrict their use of NSS APIs to
the functions listed in NSS Public Functions will remain compatible with
future versions of the NSS shared libraries.

Bugs discovered should be reported by filing a bug report at <
https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS>

Release notes are available at <
https://firefox-source-docs.mozilla.org/security/nss/releases/index.html>.

-- 
You received this message because you are subscribed to the Google Groups "[email protected]" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-tech-crypto/CAFgAd7EwKSqq3mH2k_pSKCLU-c4W_3VbAPabh9h3xpo0%3DzTSTA%40mail.gmail.com.

--000000000000fdd3e10651dc8f5f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Network Security Services (NSS) 3.124 was released on 15 M=
ay 2026.<br><br>The HG tag is NSS_3_124_RTM. This version of NSS requires N=
SPR 4.38.2 or newer. The latest version of NSPR is 4.39.<br><br>NSS 3.124 s=
ource distributions are available on <a href=3D"http://ftp.mozilla.org">ftp=
.mozilla.org</a> for secure HTTPS download:<br><br>&lt;<a href=3D"https://f=
tp.mozilla.org/pub/security/nss/releases/NSS_3_124_RTM/src/">https://ftp.mo=
zilla.org/pub/security/nss/releases/NSS_3_124_RTM/src/</a>&gt;<br><br>Chang=
es:<br>=C2=A0 =C2=A0 Bug 2032562 - Add test for PKCS7 digest array alignmen=
t.<br>=C2=A0 =C2=A0 Bug 2030093 - Add test for rejection of excessively lar=
ge ASN.1 SEQUENCE OF in quickder.<br>=C2=A0 =C2=A0 Bug 2030994 - Add test f=
or CMS content size validation.<br>=C2=A0 =C2=A0 Bug 2030995 - Add regressi=
on tests for DSAU signature decoding.<br>=C2=A0 =C2=A0 Bug 2031030 - Add te=
st for S/MIME profile lookup on temp certs.<br>=C2=A0 =C2=A0 Bug 2031343 - =
Test case for post-handshake auth and many certificate requests.<br>=C2=A0 =
=C2=A0 Bug 2019233 - Add test for intra-arena ASan redzones.<br>=C2=A0 =C2=
=A0 Bug 2033058 - update nss_status flags one at a time.<br>=C2=A0 =C2=A0 B=
ug 2029803 - add defensive info-&gt;len check in PK11_HPKE_SetupS and PK11_=
HPKE_SetupR.<br>=C2=A0 =C2=A0 Bug 2029403 - avoid PORT_Strdup in ssl_Decode=
ResumptionToken.<br>=C2=A0 =C2=A0 Bug 2020596 - add runtime check on decode=
d resumption token session id.<br>=C2=A0 =C2=A0 Bug 2035882 - improve mach =
try error handling.<br>=C2=A0 =C2=A0 Bug 2030798 - clang format.<br>=C2=A0 =
=C2=A0 Bug 2030798 - add comprehensive SECItem and SECItemArray tests.<br>=
=C2=A0 =C2=A0 Bug 2033058 - add bugzilla_cf_status_nss.py script.<br>=C2=A0=
 =C2=A0 Bug 2033057 - regenerate some recent release notes.<br>=C2=A0 =C2=
=A0 Bug 2033057 - fix bug list output by release note and email scripts.<br=
>=C2=A0 =C2=A0 Bug 2031190 - test removal from trust domain email cache.<br=
>=C2=A0 =C2=A0 Bug 2033208 - fix &quot;testing if key corruption is detecte=
d in attribute&quot; failures with sqlite-3.53.0.<br>=C2=A0 =C2=A0 Bug 2035=
348 - build sqlite3 shell for Windows CI runners.<br>=C2=A0 =C2=A0 Bug 2030=
366 - avoid race with module unloading in NSSTrustDomain_FindTokensByURI.<b=
r>=C2=A0 =C2=A0 Bug 2030192 - add ImportEd25519WithNonEmptyAlgorithmParams =
test.<br>=C2=A0 =C2=A0 Bug 2034258 - add CLAUDE.md and .mcp.json.<br>=C2=A0=
 =C2=A0 Bug 2034244 - add a mach try command.<br>=C2=A0 =C2=A0 Bug 2031042 =
- remove dead condition in sec_asn1d_check_and_subtract_length.<br>=C2=A0 =
=C2=A0 Bug 2030374 - avoid integer truncation in nssCKObject_GetAttributes.=
<br>=C2=A0 =C2=A0 Bug 2030564 - add defensive input validation to sftk_comp=
ute_ANSI_X9_63_kdf.<br>=C2=A0 =C2=A0 Bug 2029765 - avoid refcount over-rele=
ase in nssTokenObjectCache error path [@ nssToken_Destroy].<br>=C2=A0 =C2=
=A0 Bug 2029883 - sdb: enforce that metaData&#39;s id key is unique when re=
ading.<br>=C2=A0 =C2=A0 Bug 2023478 - improve handling of escape sequences =
in pk11uri_ParseAttributes.<br>=C2=A0 =C2=A0 Bug 2030570 - use correct data=
 for ID comparison in transfer_uri_certs_to_collection.<br>=C2=A0 =C2=A0 Bu=
g 2030573 - fix truncation of ulValueLen in sdb_FindObjectsInit.<br>=C2=A0 =
=C2=A0 Bug 2033783 - reject DTLS 1.3 Server Hello after HVR without capping=
 ss-&gt;vrange.max.<br>=C2=A0 =C2=A0 Bug 2034157 - set previous-nss-release=
 for abicheck.<br>=C2=A0 =C2=A0 Bug 2032389 - Skip `PR_Sleep` yield for non=
-blocking sockets in `ssl3_SendApplicationData`.<br>=C2=A0 =C2=A0 Bug 20336=
50 - consistently protect PK11SlotInfo::maxKeyCount with freeListLock.<br>=
=C2=A0 =C2=A0 Bug 2030985 - Remove CRMF from testing and manifests.<br>=C2=
=A0 =C2=A0 Bug 2026711 - Remove unused RSA blind signature implementation f=
rom freebl.<br><br>NSS 3.124 shared libraries are backwards-compatible with=
 all older NSS 3.x shared libraries. A program linked with older NSS 3.x sh=
ared libraries will work with this new version of the shared libraries with=
out recompiling or relinking. Furthermore, applications that restrict their=
 use of NSS APIs to the functions listed in NSS Public Functions will remai=
n compatible with future versions of the NSS shared libraries.<br><br>Bugs =
discovered should be reported by filing a bug report at &lt;<a href=3D"http=
s://bugzilla.mozilla.org/enter_bug.cgi?product=3DNSS">https://bugzilla.mozi=
lla.org/enter_bug.cgi?product=3DNSS</a>&gt;<br><br>Release notes are availa=
ble at &lt;<a href=3D"https://firefox-source-docs.mozilla.org/security/nss/=
releases/index.html">https://firefox-source-docs.mozilla.org/security/nss/r=
eleases/index.html</a>&gt;.</div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;[email protected]&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">dev-tech=
[email protected]</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/a/mozill=
a.org/d/msgid/dev-tech-crypto/CAFgAd7EwKSqq3mH2k_pSKCLU-c4W_3VbAPabh9h3xpo0=
%3DzTSTA%40mail.gmail.com?utm_medium=3Demail&utm_source=3Dfooter">https://g=
roups.google.com/a/mozilla.org/d/msgid/dev-tech-crypto/CAFgAd7EwKSqq3mH2k_p=
SKCLU-c4W_3VbAPabh9h3xpo0%3DzTSTA%40mail.gmail.com</a>.<br />

--000000000000fdd3e10651dc8f5f--