CVE-2025-3608CWE-362

CVE-2025-3608

Medium · published April 15, 2025

CVSS v3.1

6.5

EPSS

Percentile

23.8

In the wild

Unconfirmed

What it is

A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.2.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00320 · 23.8th percentile
Weakness: CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published: 2025-04-15T17:15Z

Affected products (1)

Product	Versions	Fixed in
mozilla/firefox	< 137.0.2	137.0.2

References (3)

https://bugzilla.mozilla.org/show_bug.cgi?id=1951554 · [email protected]https://www.cve.org/CVERecord?id=CVE-2025-3608 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-25/ · [email protected]

EPSS history

Timeline

15 APR 12:57Z
Race condition in nsHttpTransaction could lead to memory corruption
cvelistv5