CVE-2010-3172: Mozilla Bugzilla

Low severity, CVSS 2.6. EPSS: 1.8% chance of exploitation in the next 30 days.

CRLF injection vulnerability in Bugzilla before 3.2.9, 3.4.x before 3.4.9, 3.6.x before 3.6.3, and 4.0.x before 4.0rc1, when Server Push is enabled in a web browser, allows remote attackers to inject arbitrary HTTP headers and content, and conduct HTTP response splitting attacks, via a crafted URL.

Affected products

• Mozilla Bugzilla: up to and including 3.2.8; version 2.0 only; version 2.2 only; version 2.4 only; version 2.6 only; version 2.8 only; …

Published 2010-11-05. Last modified 2026-06-16.