CVE-2024-3302

3.7 lowEPSS 0.8%

Low (3.7) in mozilla. EPSS 0.8% chance of exploitation in the next 30 days.

There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

Severity

CVSS 3.1

3.7 low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-770
Published: 2024-04-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox
mozilla:thunderbird

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1881183
https://kb.cert.org/vuls/id/421644
https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html
https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html
https://www.mozilla.org/security/advisories/mfsa2024-18/

Check your stack JSON