Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Firefox can become unresponsive from crafted webpage

CVE-2009-2953 · published 17 years ago
Summary

Firefox versions 3.0.6 through 3.0.13 and all 3.5 releases can be made to use a lot of processor time when a webpage’s JavaScript sets an unusually long value in the location hash. This can cause the browser to slow down or stop responding, preventing users from working. Updating to a newer Firefox version or applying the browser’s security patches will stop the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mozilla firefox 3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.0.12
3.0.13
3.5
3.5.1
3.5.2
3.5.3
1 more version range
cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*
Original advisory text
Mozilla Firefox 3.0.6 through 3.0.13, and 3.5.x, allows remote attackers to cause a denial of service (CPU consumption) via JavaScript code with a long string value for the hash property (aka locat...
Mozilla Firefox 3.0.6 through 3.0.13, and 3.5.x, allows remote attackers to cause a denial of service (CPU consumption) via JavaScript code with a long string value for the hash property (aka location.hash), a related issue to CVE-2008-5715.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
5% chance of attack within 30 days
Type
CWE-399Resource Management Errors
Timeline
Published24 Aug 2009
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2009-2953 · NVD
Track software like this
Free during beta