CVE-2021-29991

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 91.0.1 Thunderbird versions prior to 91.0.1

Description The issue is related to the incorrect handling of HTTP requests, which can lead to a header splitting attack against servers using HTTP/3. This allows a remote attacker to perform cross-site scripting (XSS) attacks. The vulnerability affects Firefox and Thunderbird, and it is related to the incorrect interpretation of a newline in an HTTP/3 header as two separate headers.

Recommendations For Firefox versions prior to 91.0.1, update to version 91.0.1 or later to resolve the issue. For Thunderbird versions prior to 91.0.1, update to version 91.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to servers using HTTP/3 to minimize the risk of exploitation.