CVE-2021-29991

Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers

published November 3, 2021

CVSS
—
EPSS
1%
Percentile
59.7
In the wild
Unconfirmed
What it is

Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a header splitting attack against servers using HTTP/3. This vulnerability affects Firefox < 91.0.1 and Thunderbird < 91.0.1.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00910 · 59.7th percentile
Published
2021-11-03T00:04Z
EPSS history
Timeline
  • 03 NOV 00:04Z
    Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers
    cvelistv5