CVE-2025-5270

HIGH

Firefox < 139 - Cleartext Transmission of Sensitive Information via SNI

Title source: llm
STIX 2.1

Description

In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139.

References (3)

Core 3

Scores

CVSS v3 7.5
EPSS 0.0023
EPSS Percentile 14.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-319
Status published
Products (3)
mozilla/firefox < 139.0
Mozilla/Firefox 139
Mozilla/Thunderbird 139
Published May 27, 2025
Tracked Since Feb 18, 2026