CVE-2025-0239

When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

• CWE-295

• https://bugzilla.mozilla.org/show_bug.cgi?id=1929156Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2025-01/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-02/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-04/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-05/Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html

Published

Jan 7, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0233A vulnerability was found in Codezips Project Management Sys…9.8
• CVE-2025-0234Out-of-bounds vulnerability in curve segmentation processing…5.3
• CVE-2025-0235Out-of-bounds vulnerability due to improper memory release d…5.3
• CVE-2025-0236Out-of-bounds vulnerability in slope processing during curve…5.3
• CVE-2025-0237The WebChannel API, which is used to transport various infor…5.4
• CVE-2025-0238Assuming a controlled failed memory allocation, an attacker …5.3
• CVE-2025-0240Parsing a JavaScript module as JSON could, under some circum…4
• CVE-2025-0241When segmenting specially crafted text, segmentation would c…7.7
• CVE-2025-0242Memory safety bugs present in Firefox 133, Thunderbird 133, …6.5
• CVE-2025-0243Memory safety bugs present in Firefox 133, Thunderbird 133, …5.1
• CVE-2025-0244When redirecting to an invalid protocol scheme, an attacker …5.3
• CVE-2025-0245Under certain circumstances, a user opt-in setting that Focu…3.3