CVE-2021-29946

HIGH

Firefox < 88.0 and Firefox ESR < 78.10 - Port Blocking Bypass via Alt-Svc Header Integer Overflow

Title source: llm

Description

Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

References (4)

Core 4

Core References

Release Notes, Vendor Advisory x_refsource_misc

https://www.mozilla.org/security/advisories/mfsa2021-14/

Release Notes, Vendor Advisory x_refsource_misc

https://www.mozilla.org/security/advisories/mfsa2021-16/

Release Notes, Vendor Advisory x_refsource_misc

https://www.mozilla.org/security/advisories/mfsa2021-15/

Permissions Required, Vendor Advisory x_refsource_misc

https://bugzilla.mozilla.org/show_bug.cgi?id=1698503

Scores

CVSS v3 8.8

EPSS 0.0016

EPSS Percentile 36.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-190

Status published

Products (3)

mozilla/firefox < 88.0

mozilla/firefox_esr < 78.10

mozilla/thunderbird < 78.10

Published Jun 24, 2021

Tracked Since Feb 18, 2026