CVE-2025-3608
Race condition in nsHttpTransaction could lead to memory corruption
6.5 MediumFix available
A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
0.33%Up 0.3 points since Apr 16, 2025
What each source reports
CVE List Score used
Race condition in nsHttpTransaction could lead to memory corruption
A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.2.
- Record
CVE-2025-3608- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
EUVDEUVD-2025-10975
A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.2.
- Record
EUVD-2025-10975- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6rrc-vwrv-cwxc
A race condition existed in nsHttpTransaction that could have been exploited to cause memory...
A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability affects Firefox < 137.0.2.
- Record
GHSA-6rrc-vwrv-cwxc- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
NVD
A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.2.
- Record
CVE-2025-3608- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-3608
A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.2.
- Record
UBUNTU-CVE-2025-3608- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15005-1 No score
MozillaFirefox-137.0.2-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-137.0.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15005-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11373-1 No score
firefox-esr-153.0-1.1 on GA media
These are all security issues fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11373-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mozjs52Ubuntu:18.04:LTS |
All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1 |
None known |
mozjs38Ubuntu:18.04:LTS |
All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4 |
None known |
mozjs68Ubuntu:20.04:LTS |
All versions, plus listed versions 68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1 |
None known |
mozjs52Ubuntu:20.04:LTS |
All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3 |
None known |
mozjs102Ubuntu:22.04:LTS |
All versions, plus listed versions 102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1 |
None known |
mozjs78Ubuntu:22.04:LTS |
All versions, plus listed versions 78.13.0-178.15.0-278.15.0-4ubuntu1 |
None known |
mozjs91Ubuntu:22.04:LTS |
All versions, plus listed versions 91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1 |
None known |
mozjs102Ubuntu:24.04:LTS |
All versions, plus listed versions 102.15.1-1102.15.1-3ubuntu2 |
None known |
mozjs115Ubuntu:24.04:LTS |
All versions, plus listed versions 115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4 Show 4 moreShow less115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1 |
None known |
MozillaFirefoxopenSUSE:Tumbleweed |
before 137.0.2-1.1 | 137.0.2-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 228 CVEs |
before 153.0-1.1 | 153.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-3608 is a medium vulnerability (CVSS 6.5) in Mozilla Firefox, published April 15, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in MozillaFirefox 137.0.2-1.1.
References
bugzilla.mozilla.org/show_bug.cgi?id=1951554
cve.org/CVERecord?id=CVE-2025-3608
mozilla.org/security/advisories/mfsa2025-25
nvd.nist.gov/vuln/detail/CVE-2025-3608
github.com/advisories/GHSA-6rrc-vwrv-cwxc
ubuntu.com/security/CVE-2025-3608
Show 194 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/HXRVFJX5UQQQMV3PXVEXDMHJFHJMH2V7
suse.com/security/cve/CVE-2025-3608
This page doesn't list everything
Left out here: 36 references. The JSON record has them.