CVE-2023-4055

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-01 · updated 2026-06-17
Weakness: CWE-120

Description

When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

Affected products

Debian Linux: 11.0, 12.0
Mozilla Firefox: before 116.0; from 102.0 before 102.14; from 115.0 before 115.1 — fixed in 102.14, 115.1, 116.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 102.14, 115.1, 116.0. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1782561
https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html
https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
https://www.debian.org/security/2023/dsa-5464
https://www.debian.org/security/2023/dsa-5469
https://www.mozilla.org/security/advisories/mfsa2023-29/
https://www.mozilla.org/security/advisories/mfsa2023-30/
https://www.mozilla.org/security/advisories/mfsa2023-31/
https://bugzilla.mozilla.org/show_bug.cgi?id=1782561
https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html
https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
https://www.debian.org/security/2023/dsa-5464

Get alerted when CVE-2023-4055 or the next vulnerability affects your stack