High severity8.1NVD Advisory· Published Jul 22, 2025· Updated Apr 13, 2026

CVE-2025-8036

Description

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Firefox4 versions
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*+ 3 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*range: <141.0
- cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*range: <140.1.0
- (no CPE)range: <140.1
- (no CPE)range: <141 (for Firefox 141 series) and <140.1 (for Firefox ESR 140.x series)
Mozilla Corporation/Thunderbird3 versions
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*+ 2 more
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*range: <141.0
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*range: <140.1.0
- (no CPE)range: <141 (for Thunderbird 141 series) and <140.1 (for Thunderbird 140.x series)
osv-coords66 versions
pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/MozillaFirefox-branding-SLE&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweed pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP6 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7 pkg:rpm/suse/pipewire&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5
< 140.1.0-1.1+ 65 more
- (no CPE)range: < 140.1.0-1.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 141.0-1.1
- (no CPE)range: < 140.1.0-150200.8.230.1
- (no CPE)range: < 140.1.0-1.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-112.273.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-150200.152.193.1
- (no CPE)range: < 140.1.0-112.273.1
- (no CPE)range: < 140.1.0-150200.8.230.1
- (no CPE)range: < 140.1.0-150200.8.230.1
- (no CPE)range: < 140.1.0-150200.8.230.1
- (no CPE)range: < 140.1.0-150200.8.230.1
- (no CPE)range: < 0.3.24-150300.4.8.1
- (no CPE)range: < 0.3.24-150300.4.8.1
- (no CPE)range: < 0.3.49-150400.3.7.1
- (no CPE)range: < 0.3.49-150400.3.7.1
- (no CPE)range: < 0.3.64-150500.3.7.2
- (no CPE)range: < 0.3.64-150500.3.7.2
- (no CPE)range: < 0.3.6-150200.3.11.1
- (no CPE)range: < 0.3.6-150200.3.11.1
- (no CPE)range: < 0.3.24-150300.4.8.1
- (no CPE)range: < 0.3.49-150400.3.7.1
- (no CPE)range: < 0.3.64-150500.3.7.2
- (no CPE)range: < 0.3.24-150300.4.8.1
- (no CPE)range: < 0.3.49-150400.3.7.1
- (no CPE)range: < 0.3.64-150500.3.7.2
- (no CPE)range: < 1.8.0-150200.5.8.1
- (no CPE)range: < 1.8.0-150200.5.8.1
- (no CPE)range: < 1.10.1-150400.3.8.1
- (no CPE)range: < 1.10.1-150400.3.8.1
- (no CPE)range: < 1.16.0-150500.3.8.1
- (no CPE)range: < 1.16.0-150500.3.8.1
- (no CPE)range: < 1.8.0-150200.5.8.1
- (no CPE)range: < 1.10.1-150400.3.8.1
- (no CPE)range: < 1.16.0-150500.3.8.1
- (no CPE)range: < 1.8.0-150200.5.8.1
- (no CPE)range: < 1.10.1-150400.3.8.1
- (no CPE)range: < 1.16.0-150500.3.8.1

Patches

Vulnerability mechanics

References

www.mozilla.org/security/advisories/mfsa2025-56/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2025-59/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2025-61/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2025-63/nvdVendor Advisory
bugzilla.mozilla.org/show_bug.cginvdPermissions Required
www.kb.cert.org/vuls/id/652514nvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000