CVE-2026-4704
Published: 24 March 2026
Description
Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely identification, testing, and installation of patches that fix the WebRTC signaling resource exhaustion issue.
Implements denial-of-service protections tailored to prevent resource exhaustion from remote unauthenticated malformed WebRTC signaling messages.
Protects resource availability by monitoring and restricting consumption to counter uncontrolled resource usage leading to crashes in the WebRTC component.
Security SummaryAI
CVE-2026-4704 is a denial-of-service vulnerability in the WebRTC Signaling component affecting Mozilla Firefox, Firefox ESR, Thunderbird, and related products. The issue, associated with CWE-400 (Uncontrolled Resource Consumption) and scored 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), enables resource exhaustion leading to application crashes or significant performance degradation. It was publicly disclosed on March 24, 2026, and addressed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Attackers can exploit this vulnerability remotely over the network with low complexity, requiring no privileges, authentication, or user interaction. Any unauthenticated remote adversary capable of sending malformed WebRTC signaling messages to a vulnerable browser or client can trigger the DoS condition, disrupting availability by consuming excessive resources in the affected component.
Mozilla's security advisories (MFSA 2026-20 through 2026-24) and the associated Bugzilla entry (bug 2014868) detail the patch deployments in the specified versions, recommending immediate upgrades to mitigate the issue. No workarounds are mentioned in the provided references.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of the WebRTC signaling vulnerability directly triggers uncontrolled resource consumption (CWE-400), enabling application exhaustion and DoS via software vulnerability exploitation.