CVE-2024-9399

Description

A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

Reserved 2024-10-01 | Published 2024-10-01 | Updated 2024-10-30 | Assigner mozilla

Problem types

Specially crafted WebTransport requests could lead to denial of service

Product status

Any version before 131
affected

Any version before 128.3
affected

Any version before 128.3
affected

Any version before 131
affected

Credits

Marten Richter

References

bugzilla.mozilla.org/show_bug.cgi?id=1907726

www.mozilla.org/security/advisories/mfsa2024-46/

www.mozilla.org/security/advisories/mfsa2024-47/

www.mozilla.org/security/advisories/mfsa2024-49/

www.mozilla.org/security/advisories/mfsa2024-50/

cve.org (CVE-2024-9399)

nvd.nist.gov (CVE-2024-9399)

Download JSON