CVE-2026-4700: 
NixOS vulnerability analysis and mitigation

CVE-2026-4700 is a mitigation bypass vulnerability in the Networking: HTTP component of Mozilla Firefox and Thunderbird. Reported by researcher "pizzahunthack1" and disclosed on March 24, 2026, it affects Firefox versions prior to 149, Firefox ESR versions prior to 140.9, Thunderbird versions prior to 149, and Thunderbird ESR versions prior to 140.9. Mozilla rated the vulnerability as "moderate" impact in its advisories, while the CVSS v3.1 base score assigned by NVD is 9.8 (Critical) (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

The vulnerability is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling) and CWE-288 (Authentication Bypass Using an Alternate Path or Channel). It resides in Firefox's HTTP networking stack, where a flaw allows an attacker to bypass existing security mitigations — potentially enabling HTTP request smuggling or authentication bypass through an alternate channel. The attack vector is network-based, requires no authentication, no privileges, and no user interaction, making it exploitable remotely without preconditions. The underlying bug is tracked as Mozilla Bug 2003766, though the bug report is access-restricted (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

Successful exploitation could allow a network-based attacker to bypass HTTP-layer security mitigations in Firefox and Thunderbird, potentially leading to unauthorized access to confidential information, modification of data in transit, or disruption of service availability. The CVSS v3.1 scoring reflects high impacts across confidentiality, integrity, and availability dimensions. In HTTP request smuggling scenarios, attackers could poison shared caches, hijack user sessions, or bypass access controls on backend systems that trust the browser's HTTP handling (Mozilla Advisory Firefox 149, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.017%, indicating a low current probability of exploitation in the wild. No threat actor attribution has been reported, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection signatures have been published by Qualys and Tenable/Nessus for vulnerability scanning purposes.

Mozilla has released patches addressing this vulnerability. Users should update to Firefox 149 or later, Firefox ESR 140.9 or later, Thunderbird 149 or later, or Thunderbird ESR 140.9 or later. No configuration-based workaround is documented; upgrading to a patched version is the only recommended remediation. Enterprise administrators should prioritize deployment across all managed endpoints given the critical CVSS score and network-based attack vector (Mozilla Advisory Firefox 149, Mozilla Advisory ESR 140.9).

The vulnerability was part of a large Firefox 149 release that patched 37 vulnerabilities, which received coverage from security news outlets including CyberSecurityNews and HealSecurity. Downstream Linux distributions including Debian, Red Hat, AlmaLinux, Rocky Linux, openSUSE, Slackware, Amazon Linux, and Mageia have all issued security advisories and updated packages. Social media activity on Mastodon noted the release, and the broader security community treated the update as routine but important given the high CVSS score assigned by NVD.