This shouldn't have happened: A vulnerability postmortem
Summary: Google Project Zero's Tavis Ormandy disclosed CVE-2021-43527, a missing bounds check in Mozilla's NSS cryptography library where an oversized digital signature is copied into a fixed-size VFYContext buffer, causing memory corruption across multiple algorithms. The bug, dubbed "BigSig," is reproducible in three OpenSSL and vfychain commands and is fixed in NSS 3.73.0.
What you should know: NSS is a widely used cross-platform cryptography library, and Ormandy notes that vendors distributing it in their products will most likely need to update or backport the patch. The bug survived years of oss-fuzz coverage, Coverity monitoring since 2008, and Chrome's own independent NSS testing, which is a reminder that coverage metrics can look healthy while the vulnerable path is never actually exercised.
Read the original at Google Project Zero ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026