CVE-2025-5270: SNI was sometimes unencrypted
In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 139 - Upgrade
Upgrade
Firefox and Thunderbirdto a version that resolves this vulnerability.Fixed in 139
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-5270?
CVE-2025-5270 has a moderate severity as it could expose SNI information even when encrypted DNS is enabled.
How do I fix CVE-2025-5270?
To fix CVE-2025-5270, update your Mozilla Firefox to version 139 or later.
Which versions of Firefox are affected by CVE-2025-5270?
CVE-2025-5270 affects all versions of Mozilla Firefox prior to 139.
What does SNI mean in the context of CVE-2025-5270?
SNI stands for Server Name Indication, which is an extension of the TLS protocol that allows a client to specify the hostname it is trying to connect to.
Can CVE-2025-5270 be exploited remotely?
Yes, CVE-2025-5270 can potentially be exploited remotely, allowing attackers to intercept unencrypted SNI traffic.