CVE-2025-26695 — Downloading of OpenPGP keys from WKD used incorrect padding
When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vu…
Published: 2025-03-10 · CVSS: 5.3 · CVSS 3.1
When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7