CVE-2026-57962 — Denial-of-service via malicious LDAP address-book server
A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Th…
Published: 2026-07-01 · CVSS: 5.3 · CVSS 3.1
A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7