CVE-2024-2613: High QUIC ACK Memory Bug in Firefox

CVE-2024-2613 is improper handling of QUIC ACK frame data in Firefox versions before 124 that could cause unrestricted memory consumption and a crash. Severity is High at 7.5. Update to Firefox 124 or later. The sections below cover affected versions, checks and next steps.

What's affected

• Firefox versions before 124 are affected.
• Firefox 124 contains the fix, per Mozilla advisory MFSA 2024-12.
• Mozilla rates the impact as low, while the NVD record scores it 7.5 and High, because the vector shows a network attack with a high availability impact. Both statements are in the sources, so judge by your own exposure.

The NVD record gives a CVSS score of 7.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Published 2024-03-19.

How to check if you're exposed

1. In Firefox, open Help, then About Firefox, and read the version number.
2. From a terminal, firefox --version prints the version on most systems.
3. On Debian or Ubuntu, dpkg -l | grep -i firefox shows the installed package. On Fedora or RHEL, rpm -q firefox does the same.
4. Check any managed or packaged builds such as Flatpak or Snap, which update on their own schedule.

What to do now

1. Update Firefox to 124 or later on every endpoint.
2. If you manage browsers centrally, confirm the update through your device management tool and find machines that lag.
3. For distributions that backport fixes, check the distribution's security notice rather than the version number alone.
4. Restart the browser after the update, since a running instance keeps the old code.

If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.

Why it matters

The flaw is in how Firefox decodes an acknowledgement frame used by QUIC, the transport under HTTP/3. Data was not sanitised during decoding, so a peer could make the browser use unbounded memory until it crashed. The result is a denial of service, not data theft or code execution, which matches the vector: availability impact high, confidentiality and integrity none.

The NVD record tags the weakness as CWE-1021, which is about improper restriction of rendered UI layers. That label does not describe a memory exhaustion bug well, so use the Mozilla description when you assess the issue.

The record tags the weakness as CWE-1021. See the Gold pages for more on the class.

The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.

Firefox 124 shipped a batch of fixes together, so updating covers more than this one issue. See the posts on CVE-2024-2614 and CVE-2024-2615 for the memory safety bugs in the same release.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Mozilla Foundation Security Advisory 2024-12

Last reviewed: 19 October 2026.