CVE-2025-8036CWE-350

CVE-2025-8036

High · published July 23, 2025

CVSS v3.1

8.1

EPSS

Percentile

35.8

In the wild

Unconfirmed

What it is

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00426 · 35.8th percentile
Weakness: CWE-350 · Reliance on Reverse DNS Resolution for a Security-Critical Action
Published: 2025-07-23T01:15Z

Affected products (4)

Product	Versions	Fixed in
mozilla/firefox	< 140.1.0	140.1.0
mozilla/firefox	< 141.0	141.0
mozilla/thunderbird	< 140.1.0	140.1.0
mozilla/thunderbird	< 141.0	141.0

References (6)

https://bugzilla.mozilla.org/show_bug.cgi?id=1960834 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-56/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-59/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-61/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-63/ · [email protected]https://www.kb.cert.org/vuls/id/652514 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

22 JUL 20:49Z
DNS rebinding circumvents CORS
cvelistv5