CVE-2021-29991: Mozilla Firefox Header Splitting Vulnerability

CVE-2021-29991 Overview

CVE-2021-29991 is an HTTP response/request splitting vulnerability in Mozilla Firefox and Thunderbird. The browser incorrectly accepted a newline character within an HTTP/3 header value, interpreting a single header as two separate headers. This parsing flaw enables header splitting attacks against servers and intermediaries communicating over HTTP/3. The issue affects Firefox versions earlier than 91.0.1 and Thunderbird versions earlier than 91.0.1. The weakness is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests).

Critical Impact
A remote attacker can inject arbitrary HTTP headers through a single crafted header value, enabling cache poisoning, session fixation, and cross-user request manipulation against HTTP/3 endpoints.

Affected Products

Mozilla Firefox versions prior to 91.0.1
Mozilla Thunderbird versions prior to 91.0.1
Any HTTP/3-capable deployment using vulnerable Mozilla client builds

Discovery Timeline

2021-11-03 - CVE-2021-29991 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-29991

Vulnerability Analysis

The vulnerability stems from improper validation of HTTP/3 header values in Firefox's networking stack. HTTP/3 transports headers using the QPACK compression format over QUIC, and individual header values must not contain line terminator characters. Firefox failed to reject newline characters embedded in header values, treating a \r\n sequence as a header boundary. An attacker controlling part of a header value, such as a redirect target or a user-supplied query parameter reflected into a response header, can inject additional headers. Downstream proxies, caches, or origin servers may then desynchronize their view of the message versus the client's view, enabling smuggling and splitting attacks. The flaw is tracked under CWE-444, which covers inconsistent HTTP message interpretation between agents.

Root Cause

The defect lies in Firefox's HTTP/3 header parsing logic, which did not enforce RFC 9114 rules prohibiting \n and \r inside field values. The parser split header values on newline characters rather than rejecting them outright. Technical details are documented in Mozilla Bug Report #1724896.

Attack Vector

Exploitation requires user interaction such as visiting a malicious page or following a crafted link. The attacker hosts content that triggers an HTTP/3 request containing a header value with an embedded newline. The browser transmits the split headers to a backend server, which interprets them as legitimate separate headers. This can poison shared caches, override security-relevant headers, or smuggle a second request through an intermediary. See the Mozilla Security Advisory MFSA-2021-37 for vendor analysis.

Detection Methods for CVE-2021-29991

Indicators of Compromise

HTTP/3 requests from Firefox clients containing %0d%0a or raw CRLF sequences in header values observed at proxies or WAFs
Cache entries with duplicate or unexpected response headers tied to user-controlled inputs
Backend logs showing two logical requests originating from a single client connection

Detection Strategies

Inspect QUIC/HTTP/3 traffic at edge proxies for header values containing 0x0A or 0x0D bytes and alert on any matches
Correlate browser user-agent strings reporting Firefox versions below 91.0.1 with HTTP/3 sessions to identify vulnerable endpoints
Review web application logs for anomalous header duplication or unexpected Host, Cookie, or Content-Length injection patterns

Monitoring Recommendations

Enable verbose HTTP/3 logging on reverse proxies and CDNs that terminate QUIC connections
Track Firefox and Thunderbird version inventory through endpoint telemetry and flag installations below 91.0.1
Monitor cache infrastructure for poisoning indicators such as mismatched Vary headers and unexpected content served to multiple users

How to Mitigate CVE-2021-29991

Immediate Actions Required

Upgrade Firefox to version 91.0.1 or later on all managed endpoints
Upgrade Thunderbird to version 91.0.1 or later across user mailboxes
Audit web applications for reflected header values and add server-side CRLF stripping as defense in depth

Patch Information

Mozilla resolved the issue in Firefox 91.0.1 and Thunderbird 91.0.1. Detailed remediation guidance is available in the Mozilla Security Advisory MFSA-2021-37 and the technical discussion in Mozilla Bug Report #1724896.

Workarounds

Disable HTTP/3 support in Firefox by setting network.http.http3.enabled to false in about:config until patching is complete
Configure upstream proxies and WAFs to reject HTTP/3 requests containing CRLF sequences in header values
Enforce strict input validation on any server-side code that echoes user input into response headers to block header injection chains

bash

# Configuration example: disable HTTP/3 via enterprise policy (policies.json)
{
  "policies": {
    "Preferences": {
      "network.http.http3.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}