Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-5270

SNI was sometimes unencrypted

Description

In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mozilla Firefox

  • 139 to ≤ *unaffected

Mozilla Thunderbird

  • 139 to ≤ *unaffected

References