CVE-2021-29991
📋 TL;DR
Firefox and Thunderbird incorrectly accepted newline characters in HTTP/3 headers, interpreting them as separate headers. This allows attackers to perform HTTP header splitting attacks against servers using HTTP/3, potentially injecting malicious headers or bypassing security controls. Affects Firefox < 91.0.1 and Thunderbird < 91.0.1.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Thunderbird
📦 What is this software?
Firefox by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could inject arbitrary HTTP headers, potentially leading to cache poisoning, session hijacking, cross-site scripting, or bypassing security filters on HTTP/3 servers.
Likely Case
Header injection leading to cache poisoning or security filter bypass on vulnerable HTTP/3 servers visited by affected browsers.
If Mitigated
Limited impact if servers properly validate headers or use HTTP/2/1.1 instead of HTTP/3.
🎯 Exploit Status
Requires attacker to control HTTP response headers and victim to use affected browser with HTTP/3 enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 91.0.1, Thunderbird 91.0.1
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2021-37/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update to version 91.0.1 or higher. 4. Restart browser when prompted.
🔧 Temporary Workarounds
Disable HTTP/3
allTemporarily disable HTTP/3 in Firefox to prevent exploitation until patched.
about:config
Set network.http.http3.enabled to false
🧯 If You Can't Patch
- Use alternative browsers without HTTP/3 support for accessing sensitive HTTP/3 servers.
- Configure network/proxy to block or downgrade HTTP/3 connections to HTTP/2.
🔍 How to Verify
Check if Vulnerable:
Check browser version: Firefox/Thunderbird → Help → About. If version is below 91.0.1, it's vulnerable when using HTTP/3.Check Version:
firefox --version or thunderbird --versionVerify Fix Applied:
Verify version is 91.0.1 or higher in About dialog. Test HTTP/3 connections to confirm proper header handling.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP/3 header patterns with newlines in server logs
- Multiple headers from single HTTP/3 request
Network Indicators:
- HTTP/3 traffic with malformed headers containing newline characters
SIEM Query:
http.protocol: "HTTP/3" AND (http.headers contains "\n" OR http.headers contains "\r")