The vulnerability allows the TLS Server Name Indication (SNI) extension to be transmitted without encryption in certain circumstances where DNS traffic is otherwise encrypted. This flaw results in loss of confidentiality, as the domain names requested over TLS can be exposed to anyone who can observe network traffic. The weakness is identified as CWE‑319, Loss of Confidentiality via Unencrypted Communication.

Mozilla Firefox and Mozilla Thunderbird versions older than 139 are affected. The issue was resolved in Firefox 139 and Thunderbird 139. Users running earlier versions in environments that enable encrypted DNS should be aware that unencrypted SNI may still be sent.

The CVSS score of 7.5 indicates a high impact on confidentiality. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in CISA KEV. The likely attack vector is passive network monitoring of the TLS handshake (inferred from the description) in scenarios where encrypted DNS is expected to protect all TLS metadata. Although this can be observed by adversaries with access to the network path, the overall threat remains limited because the primary effect is informational leakage rather than direct system compromise.