CVE-2025-0239

MEDIUM 4.0CVE-2025-0239 · Published 07/01/2025 · updated 05/10/2026

In short

CVE-2025-0239 is a MEDIUM (CVSS 4.0) vulnerability affecting firefox (mozilla), thunderbird (mozilla).
Chance of exploitation in the next 30 days (EPSS): 0.23%, higher than 13.5% of all vulnerabilities.
Fix: update to 128.6.0, 134.0 or later.

Package	Affected versions	Patched versions
firefox mozilla	`< 128.6.0< 134.0`	`128.6.0134.0`
thunderbird mozilla	`≥ 129.0, < 134.0< 128.6.0`	`134.0128.6.0`

Description

When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

References

bugzilla.mozilla.org/show_bug.cgi · Issue Tracking
mozilla.org/security/advisories/mfsa2025-01 · Vendor Advisory
mozilla.org/security/advisories/mfsa2025-02 · Vendor Advisory
mozilla.org/security/advisories/mfsa2025-04 · Vendor Advisory
mozilla.org/security/advisories/mfsa2025-05 · Vendor Advisory
lists.debian.org/debian-lts-announce/2025/01/msg00004.html

More vulnerabilities in firefox

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

firefox

mozilla

< 128.6.0< 134.0

128.6.0134.0

thunderbird

mozilla

≥ 129.0, < 134.0< 128.6.0

134.0128.6.0

More vulnerabilities in firefox

See all →