Vulnerability · Published Jul 1, 2026 · Assigned by mozilla
CVE-2026-57962Denial-of-service via malicious LDAP address-book server
Medium 5.3
In plain English
A medium-severity uncontrolled resource consumption in Thunderbird from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | thunderbird | 1:140.13.0esr-2~deb12u1 | DEBIAN-CVE-2026-57962 |
| Debian:13 | thunderbird | 1:140.13.0esr-2~deb13u1 | DEBIAN-CVE-2026-57962 |
| Debian:14 | thunderbird | 1:140.13.0esr-1 | DEBIAN-CVE-2026-57962 |
| Ubuntu:22.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2026-57962 |
| Ubuntu:24.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2026-57962 |
| Ubuntu:25.10 | thunderbird | no fix listed | UBUNTU-CVE-2026-57962 |
| Ubuntu:26.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2026-57962 |
| Ubuntu:26.10 | thunderbird | no fix listed | UBUNTU-CVE-2026-57962 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Thunderbird | see references |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H