CVE-2006-2786: mozilla firefox
Vulnerability summary
CVE-2006-2786 is a low (CVSS 2.6) vulnerability in mozilla firefox. EPSS estimates a 1.77% chance of exploitation in the next 30 days, higher than 77.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7Timeline
- 02-06-2006PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
HTTP response smuggling vulnerability in Mozilla Firefox and Thunderbird before 1.5.0.4, when used with certain proxy servers, allows remote attackers to cause Firefox to interpret certain responses as if they were responses from two different sites via (1) invalid HTTP response headers with spaces between the header name and the colon, which might not be ignored in some cases, or (2) HTTP 1.1 headers through an HTTP 1.0 proxy, which are ignored by the proxy but processed by the client.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.77%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.77% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mozilla2 products
- firefox≤ 1.5.0.3
- thunderbird≤ 1.5.0.3
Debian1 product
- thunderbird< 1.5.0.4-1
2 vendors · 3 products
References
48 links- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9966VDB EntrySignatureX Refsource OVAL
