CVE-2025-0239: Alt-Svc ALPN validation failure when redirected

Severity: medium (CVSS 4.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-07 · updated 2026-10-05
Weakness: CWE-295

Description

When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

Affected products

Mozilla Firefox: before 128.6.0; before 134.0 — fixed in 128.6.0, 134.0
Mozilla Thunderbird: before 128.6.0; from 129.0 before 134.0 — fixed in 128.6.0, 134.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 128.6.0, 134.0; Mozilla Thunderbird 128.6.0, 134.0. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1929156
https://www.mozilla.org/security/advisories/mfsa2025-01/
https://www.mozilla.org/security/advisories/mfsa2025-02/
https://www.mozilla.org/security/advisories/mfsa2025-04/
https://www.mozilla.org/security/advisories/mfsa2025-05/
https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html

Get alerted when CVE-2025-0239 or the next vulnerability affects your stack