CVEvulnerability
CVE-2025-8036
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2025-07-22
- Last modified
- 2026-10-05
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-350
Description
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
Affected configurations
• mozilla firefox (< 140.1.0)
• mozilla firefox (< 141.0)
• mozilla thunderbird (< 140.1.0)
• mozilla thunderbird (< 141.0)
Related
Weakness · CWE (1)
- CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1960834 Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2025-56/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-59/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-61/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-63/ Vendor Advisory
- https://www.kb.cert.org/vuls/id/652514 www.kb.cert.org