Riskcovery

CVE-2025-8037

Nameless cookies shadow secure cookies

State
Published
Severity
9.1 Critical
Published
Jul 22, 2025
Updated
Jul 29, 2026
Reserved
Jul 22, 2025

Read the record on cve.org

Description

Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCISA-ADP

Weaknesses

  • CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Affected Products

ProductVersions
FirefoxMozilla
  • 140.1 through 140.*Not affected
  • 141 and laterNot affected
ThunderbirdMozilla
  • 140.1 through 140.*Not affected
  • 141 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.