CVE-2025-0239 Overview
CVE-2025-0239 is a certificate validation flaw [CWE-295] affecting Mozilla Firefox and Thunderbird. When a server uses the HTTP Alternative Services (Alt-Svc) header to redirect a client to another endpoint, Application-Layer Protocol Negotiation (ALPN) failed to properly validate certificates if the original server redirected to an insecure site. The defect allows a network-adjacent adversary to weaken the effective transport security guarantees expected by users of Firefox and Thunderbird. Mozilla resolved the issue in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
Critical Impact
An attacker positioned to influence Alt-Svc redirection can undermine TLS certificate validation, exposing traffic integrity for affected Firefox and Thunderbird clients.
Affected Products
- Mozilla Firefox versions prior to 134
- Mozilla Firefox ESR versions prior to 128.6
- Mozilla Thunderbird versions prior to 134 and 128.6
Discovery Timeline
- 2025-01-07 - CVE-2025-0239 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0239
Vulnerability Analysis
The vulnerability resides in the interaction between the HTTP Alt-Svc header and ALPN handling within Firefox and Thunderbird's network stack. Alt-Svc allows an origin server to advertise alternative endpoints, protocols, and ports for subsequent connections. ALPN negotiates the application protocol during the TLS handshake. When the original server redirected clients to an insecure site, the certificate validation logic did not enforce the expected trust checks. As a result, the client could complete a negotiation that should have been rejected on trust grounds. The issue is categorized as improper certificate validation [CWE-295].
Root Cause
The root cause is a logic gap in the code path that handles Alt-Svc redirection combined with ALPN selection. The client failed to reapply strict certificate validation to the alternative endpoint when the redirection led to an insecure destination. Mozilla addressed the flaw through advisories MFSA-2025-01, MFSA-2025-02, MFSA-2025-04, and MFSA-2025-05, with tracking in Mozilla Bug 1929156.
Attack Vector
Exploitation requires an adversary capable of influencing the Alt-Svc response returned to a Firefox or Thunderbird client, or capable of controlling the alternative endpoint referenced by the redirection. Because certificate validation is not enforced correctly in the affected path, the client may proceed with a session that should otherwise fail trust checks. The impact is limited to integrity of the affected connection; no code execution primitive is exposed.
// No verified proof-of-concept code is publicly available.
// See Mozilla Bug 1929156 and MFSA-2025-01 for technical details.
Detection Methods for CVE-2025-0239
Indicators of Compromise
- Firefox or Thunderbird client builds reporting versions earlier than 134, or ESR builds earlier than 128.6, in endpoint inventory data.
- Outbound HTTPS sessions where an Alt-Svc header directs the client to an alternative endpoint on a non-TLS port or an untrusted certificate chain.
- Unexpected downgrade from HTTPS to cleartext HTTP following an Alt-Svc-driven reconnection.
Detection Strategies
- Inventory installed Firefox and Thunderbird versions across managed endpoints and flag builds that predate the fixed releases.
- Inspect proxy and web gateway logs for Alt-Svc responses that reference endpoints with invalid or self-signed certificates.
- Correlate TLS session metadata with client user-agent strings to identify vulnerable clients establishing sessions to unusual alternative services.
Monitoring Recommendations
- Centralize browser and mail client telemetry to identify unpatched deployments.
- Alert on TLS negotiations where ALPN selection follows an Alt-Svc redirect to a previously unseen endpoint.
- Track advisory updates from Mozilla and the Debian LTS announcement for downstream distribution fixes.
How to Mitigate CVE-2025-0239
Immediate Actions Required
- Upgrade Firefox to version 134 or later on all managed workstations.
- Upgrade Firefox ESR to version 128.6 or later where the ESR channel is deployed.
- Upgrade Thunderbird to version 134 or Thunderbird 128.6 or later.
- Apply distribution-specific packages from vendors such as Debian LTS.
Patch Information
Mozilla released fixed builds referenced in MFSA-2025-01, MFSA-2025-02, MFSA-2025-04, and MFSA-2025-05. Administrators should deploy the latest available builds through their standard software distribution tooling and confirm rollout via endpoint inventory.
Workarounds
- Restrict browser and mail client egress through inspecting proxies that enforce certificate validation independent of the client.
- Disable HTTP/3 and Alt-Svc handling through enterprise policy where feasible until patched builds are deployed.
- Limit user access to untrusted origins that may leverage Alt-Svc redirection to insecure endpoints.
# Example: verify installed Firefox version on Linux endpoints
firefox --version
# Example: verify installed Thunderbird version on Linux endpoints
thunderbird --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
