CVE-2025-8037: Nameless cookies shadow secure cookies
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
Other sources
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 141 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 140.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Thunderbird ESRto a version that resolves this vulnerability.Fixed in 140.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-8037?
CVE-2025-8037 has a moderate severity rating due to its potential impact on cookie management.
How do I fix CVE-2025-8037?
To fix CVE-2025-8037, update your Mozilla Firefox or Firefox ESR to the latest version that includes the security patch.
Which versions are affected by CVE-2025-8037?
CVE-2025-8037 affects Mozilla Firefox versions up to 141 and Firefox ESR versions up to 140.1.
What is the impact of CVE-2025-8037?
CVE-2025-8037 allows a nameless cookie with an equals sign to shadow other cookies, which could lead to unexpected behavior.
Is CVE-2025-8037 specific to certain platforms?
CVE-2025-8037 is specific to the Mozilla Firefox browser and its ESR version.