Medium severity4.0NVD Advisory· Published Jan 7, 2025· Updated Apr 13, 2026
CVE-2025-0239
CVE-2025-0239
Description
When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
Affected products
3cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*+ 1 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*range: <128.6.0
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <134.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- www.mozilla.org/security/advisories/mfsa2025-01/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2025-02/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2025-04/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2025-05/nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdIssue TrackingPermissions Required
- lists.debian.org/debian-lts-announce/2025/01/msg00004.htmlnvd
News mentions
0No linked articles in our index yet.