Non notée
CVE-2021-38507 The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while…
Description
The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin with unencrypted connections on port 80. However, if a second encrypted port on the same IP address (e.g. port 8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin with HTTP. This was resolved by disabling the Opportunistic Encryption feature, which had low usage. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Firefox 94 | premières → < 94 | 94 |
| Thunderbird 91.3 | premières → < 91.3 | 91.3 |
| Firefox ESR 91.3 | premières → < 91.3 | 91.3 |
Autres CVE de Firefox
Les 2221 CVE de Firefox →
CVE-2026-120572
Incorrect boundary conditions in the Layout: Block and Inline component
8.8
Élevée
CVE-2026-118027
Frame poisoning in the Layout component
9.1
Critique
CVE-2026-118025
Other issue in the SVG component
8.8
Élevée
CVE-2026-118024
Use-after-free in the Graphics: Text component
8.8
Élevée