Veracode Vulnerability DatabaseVERACODE:46546HTTP/2 CONTINUATION Frame Processing
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
AI Score
Confidence
Low
EPSS
Percentile
10.3%
firefox is vulnerable to an HTTP/2 CONTINUATION frame processing vulnerability. The vulnerability is due to an absence of limits on the number of HTTP/2 CONTINUATION frames processed, allowing a server to potentially trigger an Out of Memory condition in the browser.
References
bugzilla.mozilla.org/show_bug.cgi?id=1881183
kb.cert.org/vuls/id/421644
lists.debian.org/debian-lts-announce/2024/04/msg00012.html
lists.debian.org/debian-lts-announce/2024/04/msg00013.html
security-tracker.debian.org/tracker/CVE-2024-3302
www.mozilla.org/security/advisories/mfsa2024-18/
www.mozilla.org/security/advisories/mfsa2024-19/
www.mozilla.org/security/advisories/mfsa2024-20/
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
AI Score
Confidence
Low
EPSS
Percentile
10.3%