CVE catalog

CVE-2025-3608

A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 25, 2026

A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpefirefoxNot reported137.0.2fixed
Ubuntumozjs5218.0452.3.1-0ubuntu3vulnerable
Ubuntumozjs5218.0452.3.1-7fakesync1vulnerable
Ubuntumozjs5218.0452.8.1-0ubuntu0.18.04.1vulnerable
Ubuntumozjs5218.0452.9.1-0ubuntu0.18.04.1vulnerable
Ubuntumozjs3818.0438.8.0~repack1-0ubuntu1vulnerable
Ubuntumozjs3818.0438.8.0~repack1-0ubuntu3vulnerable
Ubuntumozjs3818.0438.8.0~repack1-0ubuntu4vulnerable
Ubuntumozjs6820.0468.5.0-1~fakesyncvulnerable
Ubuntumozjs6820.0468.5.0-2~fakesyncvulnerable
Ubuntumozjs6820.0468.6.0-1vulnerable
Ubuntumozjs6820.0468.6.0-1ubuntu1vulnerable
Ubuntumozjs5220.0452.9.1-1build1vulnerable
Ubuntumozjs5220.0452.9.1-1ubuntu3vulnerable
Ubuntumozjs10222.04102.11.0-0ubuntu0.22.04.1vulnerable
Ubuntumozjs10222.04102.12.0-0ubuntu0.22.04.1vulnerable
Ubuntumozjs10222.04102.13.0-0ubuntu0.22.04.1vulnerable
Ubuntumozjs10222.04102.15.1-0ubuntu0.22.04.1vulnerable
Ubuntumozjs7822.0478.13.0-1vulnerable
Ubuntumozjs7822.0478.15.0-2vulnerable
Ubuntumozjs7822.0478.15.0-4ubuntu1vulnerable
Ubuntumozjs9122.0491.5.1-0ubuntu1vulnerable
Ubuntumozjs9122.0491.6.0-1vulnerable
Ubuntumozjs9122.0491.6.0-2vulnerable
Ubuntumozjs9122.0491.7.0-2vulnerable
Ubuntumozjs9122.0491.10.0-0ubuntu1vulnerable
Ubuntumozjs10224.04102.15.1-1vulnerable
Ubuntumozjs10224.04102.15.1-3ubuntu2vulnerable
Ubuntumozjs11524.04115.3.0-0ubuntu1vulnerable
Ubuntumozjs11524.04115.4.0-2vulnerable
Ubuntumozjs11524.04115.5.0-1vulnerable
Ubuntumozjs11524.04115.6.0-1vulnerable
Ubuntumozjs11524.04115.7.0-4vulnerable
Ubuntumozjs11524.04115.8.0-1vulnerable
Ubuntumozjs11524.04115.9.0-1vulnerable
Ubuntumozjs11524.04115.9.0-1build1vulnerable
Ubuntumozjs11524.04115.10.0-1vulnerable
OpensuseMozillaFirefoxtumbleweed137.0.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpefirefoxcpeNot reported137.0.2Not reportedNVD-CVE-2025-3608Not reported
OpensuseMozillaFirefoxrpmtumbleweed137.0.2-1.1Not reportedOPENSUSE-SU-2025:15005-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [MozillaFirefox-branding-upstream]Unknown

    Source package: [MozillaFirefox]

    Details (1)

    • 154.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 137.0.2-1.1

      Version impact unknown

      nvd · MozillaFirefox · opensuse · tumbleweed

  • [MozillaFirefox-devel]Unknown

    Source package: [MozillaFirefox]

    Details (1)

    • 154.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 137.0.2-1.1

      Version impact unknown

      nvd · MozillaFirefox · opensuse · tumbleweed

  • [MozillaFirefox-translations-common]Unknown

    Source package: [MozillaFirefox]

    Details (1)

    • 154.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 137.0.2-1.1

      Version impact unknown

      nvd · MozillaFirefox · opensuse · tumbleweed

  • [MozillaFirefox-translations-other]Unknown

    Source package: [MozillaFirefox]

    Details (1)

    • 154.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 137.0.2-1.1

      Version impact unknown

      nvd · MozillaFirefox · opensuse · tumbleweed

  • [MozillaFirefox]Fixed

    Source package: [MozillaFirefox]

    Details (1)

    • 154.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 137.0.2-1.1

      nvd · MozillaFirefox · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]