CVE-2026-110249
published 2026-10-13CVE-2026-110249: A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep…
PriorityP340high8.6CVSS 3.1
AVLACLPRNUIRSCCHIHAH
EPSS
0.18%
7.5th percentile
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | thunderbird | < Thunderbird 158 | Thunderbird 158 |
| mozilla | thunderbird | < Thunderbird 153.5 | Thunderbird 153.5 |
| mozilla | thunderbird | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thunderbird: thunderbird: Denial of Service via excessive attributes in SOAP response
vendor_redhat·2026-10-13·CVSS 5.3
CVE-2026-110249 [MEDIUM] CWE-770 thunderbird: thunderbird: Denial of Service via excessive attributes in SOAP response
thunderbird: thunderbird: Denial of Service via excessive attributes in SOAP response
A flaw was found in Thunderbird. A malicious, compromised, or intercepted Exchange server can cause a Denial of Service (DoS) by returning a crafted Simple Object Access Protocol (SOAP) response containing an element with an excessive number of attributes. Processing these attributes monopolizes the application's main thread, rendering the client unresponsive for an extended period.
Package: thunderbird (Red Hat Enterprise Linux 10) - Fix deferred
Package: thunderbird (Red Hat Enterprise Linux 8) - Fix deferred
Package: thunderbird (Red Hat Enterprise Linux 9) - Out of support scope
Mozilla
Mozilla Foundation Security Advisory 2026-109: CVE-2026-110249
vendor_mozilla
CVE-2026-110249 Mozilla Foundation Security Advisory 2026-109: CVE-2026-110249
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-110249
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
Mozilla
Mozilla Foundation Security Advisory 2026-110: CVE-2026-110249
vendor_mozilla
CVE-2026-110249 Mozilla Foundation Security Advisory 2026-110: CVE-2026-110249
Mozilla Foundation Security Advisory 2026-110
CVE: CVE-2026-110249
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.5
GHSA
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for
ghsa_unreviewed·2026-10-13
CVE-2026-110249 A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-110249 thunderbird: Denial-of-service in the Exchange email component [fedora-all]
bugzilla·2026-10-27·CVSS 8.6
CVE-2026-110249 [HIGH] CVE-2026-110249 thunderbird: Denial-of-service in the Exchange email component [fedora-all]
CVE-2026-110249 thunderbird: Denial-of-service in the Exchange email component [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
Bugzilla
CVE-2026-110249 thunderbird: thunderbird: Denial of Service via excessive attributes in SOAP response
bugzilla·2026-10-13
CVE-2026-110249 [MEDIUM] CVE-2026-110249 thunderbird: thunderbird: Denial of Service via excessive attributes in SOAP response
CVE-2026-110249 thunderbird: thunderbird: Denial of Service via excessive attributes in SOAP response
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
2026-10-13
Published