Skip to main content

Mozilla Thunderbird CVE-2026-57962

| EUVDEUVD-2026-40861 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-07-01 mozilla GHSA-qg45-rc8c-9676
Mozilla Denial Of Service Thunderbird Red Hat Suse
5.3
CVSS 3.1 · Vendor: mozilla
Share

Severity by source

Vendor (mozilla) PRIMARY
5.3 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
5.3 MEDIUM

AC:H reflects prerequisite attacker LDAP server control; UI:R for autocomplete trigger; A:H for crash; no C/I impact; scope unchanged.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
Jul 22, 2026 - 18:47 vuln.today
CVE Published
Jul 01, 2026 - 00:58 cve.org
MEDIUM 5.3
CVE Published
Jul 01, 2026 - 00:58 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

AnalysisAI

Memory exhaustion denial-of-service in Mozilla Thunderbird's LDAP address-book autocomplete client allows a malicious or compromised LDAP server to crash the application by returning unbounded data payloads. Affected users are those explicitly configured to query an LDAP directory server for autocomplete, making this a targeted rather than opportunistic attack. No public exploit has been identified at time of analysis, and EPSS at 0.14% (4th percentile) alongside a CISA SSVC exploitation rating of 'none' confirms very low real-world urgency.

Technical ContextAI

The vulnerability stems from CWE-400 (Uncontrolled Resource Consumption) in Thunderbird's built-in LDAP client, which is used to resolve email addresses via directory server autocomplete when composing messages. LDAP (Lightweight Directory Access Protocol) allows Thunderbird to query corporate or personal directory servers as the user types in the recipient field. The root cause is the absence of server-response size limits or memory caps in the LDAP client implementation: a server can stream arbitrarily large payloads across multiple response messages, accumulating data in Thunderbird's heap until the process exhausts available memory and crashes. The affected component is identified by CPE cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* - all Thunderbird versions prior to the patched releases across all platforms.

RemediationAI

Upgrade to Thunderbird 152.0.1 (standard channel) or Thunderbird 140.12.1 (ESR channel), both of which contain the vendor-released patch as confirmed by Mozilla advisories MFSA2026-62, MFSA2026-63, and MFSA2026-64 at https://www.mozilla.org/security/advisories/. For users or organizations unable to immediately patch, the attack surface can be eliminated entirely by disabling LDAP address-book autocomplete: navigate to Edit > Account Settings > Composition & Addressing and remove or disable any configured LDAP Directory Server. The trade-off is loss of directory-based address autocomplete functionality. Organizations relying on corporate LDAP for address lookup should additionally ensure LDAP traffic (default port 389/636) is restricted to known, trusted directory servers via firewall rules or network segmentation, preventing substitution or MitM of the LDAP endpoint until patching is complete.

More in Thunderbird

View all
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2024-9680 CRITICAL POC
9.8

Alpine Linux: mozjs fixed in 128.3.1-r0
CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

CVE-2022-26485 HIGH POC
8.8 Dec 22

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. Rated high severity (CVSS

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

CVE-2026-57962 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy