CVE-2025-0239

Description

When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6.

Reserved 2025-01-06 | Published 2025-01-07 | Updated 2025-01-13 | Assigner mozilla

Problem types

Alt-Svc ALPN validation failure when redirected

Product status

Any version before 134
affected

Any version before 128.6
affected

Any version before 134
affected

Any version before 128.6
affected

Credits

Paul Gerste

References

bugzilla.mozilla.org/show_bug.cgi?id=1929156

www.mozilla.org/security/advisories/mfsa2025-01/

www.mozilla.org/security/advisories/mfsa2025-02/

www.mozilla.org/security/advisories/mfsa2025-04/

www.mozilla.org/security/advisories/mfsa2025-05/

cve.org (CVE-2025-0239)

nvd.nist.gov (CVE-2025-0239)

Download JSON