Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ycjq-pc6z-b7d2
Vulnerability ID VCID-ycjq-pc6z-b7d2
Aliases CVE-2009-2408
Summary IOActive security researcher Dan Kaminsky reported a mismatch in the treatment of domain names in SSL certificates between SSL clients and the Certificate Authorities (CA) which issue server certificates. In particular, if a malicious person requested a certificate for a host name with an invalid null character in it most CAs would issue the certificate if the requester owned the domain specified after the null, while most SSL clients (browsers) ignored that part of the name and used the unvalidated part in front of the null. This made it possible for attackers to obtain certificates that would function for any site they wished to target. These certificates could be used to intercept and potentially alter encrypted communication between the client and a server such as sensitive bank account transactions.This vulnerability was independently reported to us by researcher Moxie Marlinspike who also noted that since Firefox relies on SSL to protect the integrity of security updates this attack could be used to serve malicious updates. Mozilla would like to thank Dan and the Microsoft Vulnerability Research team for coordinating a multiple-vendor response to this problem.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.01855 https://api.first.org/data/v1/epss?cve=CVE-2009-2408
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2009-42
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-2408.json
https://api.first.org/data/v1/epss?cve=CVE-2009-2408
510251 https://bugzilla.redhat.com/show_bug.cgi?id=510251
539934 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=539934
CVE-2009-2408 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2408
GLSA-201301-01 https://security.gentoo.org/glsa/201301-01
mfsa2009-42 https://www.mozilla.org/en-US/security/advisories/mfsa2009-42
RHSA-2009:1184 https://access.redhat.com/errata/RHSA-2009:1184
RHSA-2009:1186 https://access.redhat.com/errata/RHSA-2009:1186
RHSA-2009:1190 https://access.redhat.com/errata/RHSA-2009:1190
RHSA-2009:1207 https://access.redhat.com/errata/RHSA-2009:1207
RHSA-2009:1432 https://access.redhat.com/errata/RHSA-2009:1432
USN-810-1 https://usn.ubuntu.com/810-1/
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.83342
EPSS Score 0.01855
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T08:27:39.716523+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2009/mfsa2009-42.md 38.6.0