CVE catalog
CVE-2025-8036
Thunderbird cached CORS preflight responses across IP…
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
- Severity
- High · CVSS 8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.45% · Oct 27, 2026
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [],
"fixed_versions": [],
"distribution_packages": [
{
"name": "firefox",
"ranges": [
{
"fixed": "141.0",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "141.0",
"provider_record_id": "NVD-CVE-2025-8036"
},
{
"name": "firefox",
"ranges": [
{
"fixed": "141.0",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "141.0",
"provider_record_id": "NVD-CVE-2025-8036"
},
{
"name": "thunderbird",
"ranges": [
{
"fixed": "141.0",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "141.0",
"provider_record_id": "NVD-CVE-2025-8036"
},
{
"name": "thunderbird",
"ranges": [
{
"fixed": "141.0",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "141.0",
"provider_record_id": "NVD-CVE-2025-8036"
},
{
"name": "mozjs52",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "18.04",
"versions": [
"52.3.1-0ubuntu3",
"52.3.1-7fakesync1",
"52.8.1-0ubuntu0.18.04.1",
"52.9.1-0ubuntu0.18.04.1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2025-8036"
},
{
"name": "mozjs38",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "18.04",
"versions": [
"38.8.0~repack1-0ubuntu1",
"38.8.0~repack1-0ubuntu3",
"38.8.0~repack1-0ubuntu4"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2025-8036"
},
{
"name": "mozjs68",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "20.04",
"versions": [
"68.5.0-1~fakesync",
"68.5.0-2~fakesync",
"68.6.0-1",
"68.6.0-1ubuntu1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2025-8036"
},
{
"name": "mozjs52",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "20.04",
"versions": [
"52.9.1-1build1",
"52.9.1-1ubuntu3"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2025-8036"
},
{
"name": "mozjs102",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "22.04",
"versions": [
"102.11.0-0ubuntu0.22.04.1",
"102.12.0-0ubuntu0.22.04.1",
"102.13.0-0ubuntu0.22.04.1",
"102.15.1-0ubuntu0.22.04.1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2025-8036"
},
{
"name": "mozjs78",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "22.04",
"versions": [
"78.13.0-1",
"78.15.0-2",
"78.15.0-4ubuntu1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2025-8036"
},
{
"name": "mozjs91",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "22.04",
"versions": [
"91.5.1-0ubuntu1",
"91.6.0-1",
"91.6.0-2",
"91.7.0-2",
"91.10.0-0ubuntu1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2025-8036"
},
{
"name": "thunderbird",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:140.7.1+build1-0ubuntu0.22.04.1"
}
]
}
],
"release": "22.04",
"versions": [
"1:91.1.2+build1-0ubuntu1",
"1:91.3.0+build2-0ubuntu1",
"1:91.3.1+build1-0ubuntu1",
"1:91.3.2+build1-0ubuntu1",
"1:91.4.0+build1.1-0ubuntu1",
"1:91.4.0+build2-0ubuntu1",
"1:91.5.0+build1-0ubuntu1",
"1:91.5.1+build1-0ubuntu1",
"1:91.6.1+build1-0ubuntu1",
"1:91.7.0+build1-0ubuntu1",
"1:91.7.0+build2-0ubuntu1",
"1:91.8.0+build2-0ubuntu1",
"1:91.9.1+build1-0ubuntu0.22.04.1",
"1:91.11.0+build2-0ubuntu0.22.04.1",
"1:102.2.2+build1-0ubuntu0.22.04.1",
"1:102.4.2+build2-0ubuntu0.22.04.1",
"1:102.7.1+build2-0ubuntu0.22.04.1",
"1:102.8.0+build2-0ubuntu0.22.04.1",
"1:102.9.0+build1-0ubuntu0.22.04.1",
"1:102.10.0+build2-0ubuntu0.22.04.1",
"1:102.11.0+build1-0ubuntu0.22.04.1",
"1:102.13.0+build1-0ubuntu0.22.04.1",
"1:102.15.0+build1-0ubuntu0.22.04.1",
"1:102.15.1+build1-0ubuntu0.22.04.1",
"1:115.3.1+build1-0ubuntu0.22.04.2",
"1:115.4.1+build1-0ubuntu0.22.04.1",
"1:115.5.0+build1-0ubuntu0.22.04.1",
"1:115.6.0+build2-0ubuntu0.22.04.1",
"1:115.8.1+build1-0ubuntu0.22.04.1",
"1:115.9.0+build1-0ubuntu0.22.04.1",
"1:115.10.1+build1-0ubuntu0.22.04.1",
"1:115.11.0+build2-0ubuntu0.22.04.1",
"1:115.12.0+build3-0ubuntu0.22.04.1",
"1:115.13.0+build5-0ubuntu0.22.04.1",
"1:115.15.0+build1-0ubuntu0.22.04.1",
"1:115.16.0+build2-0ubuntu0.22.04.1",
"1:115.18.0+build1-0ubuntu0.22.04.1",
"1:128.12.0+build1-0ubuntu0.22.04.1"
],
"ecosystem": "deb",
"fixed_version": "1:140.7.1+build1-0ubuntu0.22.04.1",
"provider_record_id": "UBUNTU-CVE-2025-8036"
},
{
"name": "mozjs102",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "24.04",
"versions": [
"102.15.1-1",
"102.15.1-3ubuntu2"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2025-8036"
},
{
"name": "mozjs115",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "24.04",
"versions": [
"115.3.0-0ubuntu1",
"115.4.0-2",
"115.5.0-1",
"115.6.0-1",
"115.7.0-4",
"115.8.0-1",
"115.9.0-1",
"115.9.0-1build1",
"115.10.0-1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2025-8036"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_02529-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2025-8036]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2025-8036]
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-8036.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1623.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]