Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1960834 | Permissions Required |
| https://www.mozilla.org/security/advisories/mfsa2025-56/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-59/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-61/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-63/ | Vendor Advisory |
| https://www.kb.cert.org/vuls/id/652514 |
Configurations
Configuration 1 (hide)
|
History
05 Oct 2026, 15:10
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (es) Thunderbird almacenó en caché las respuestas de preflight de CORS tras los cambios de dirección IP. Esto permitió eludir CORS mediante revinculación de DNS. Esta vulnerabilidad afecta a Firefox menor que 141, Firefox ESR menor que 140.1, Thunderbird menor que 141 y Thunderbird menor que 140.1. |
30 Sep 2026, 18:10
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (es) Thunderbird almacenó en caché las respuestas de preflight de CORS tras los cambios de dirección IP. Esto permitió eludir CORS mediante revinculación de DNS. Esta vulnerabilidad afecta a Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141 y Thunderbird < 140.1. |
Information
Published : 2025-07-22 21:15
Updated : 2026-10-05 15:10
NVD link : CVE-2025-8036
Mitre link : CVE-2025-8036
CVE.ORG link : CVE-2025-8036
JSON object : View
Products Affected
mozilla
- firefox
- thunderbird
CWE
CWE-350
Reliance on Reverse DNS Resolution for a Security-Critical Action