CVE-2024-3302

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Apr 16, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-330207.5Transient DOS while processing TID-to-link mapping IE elements.CVE-2024-330217.8Memory corruption while processing IOCTL call to set metainfo.CVE-2024-330227.8Memory corruption while allocating memory in HGSL driver.CVE-2024-330237.8Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.CVE-2024-330247.5Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.CVE-2024-330257.5Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.CVE-2024-330267.5Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.CVE-2024-330277.8Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page tableCVE-2024-330287.8Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.CVE-2024-330296.7Memory corruption while handling the PDR in driver for getting the remote heap maps.CVE-2024-33035.7An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starCVE-2024-330306.7Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size.