CVE-2026-84642
published 2026-09-01CVE-2026-84642: The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.42%
34.5th percentile
The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | thunderbird | < Thunderbird 155 | Thunderbird 155 |
| mozilla | thunderbird | < Thunderbird 153.2 | Thunderbird 153.2 |
| mozilla | thunderbird | < 153.2.0 | 153.2.0 |
| mozilla | thunderbird | >= 154.0 < 155.0 | 155.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thunderbird: Allowed UNC hostnames for attachments interpreted as a regular expression
vendor_redhat·2026-09-01·CVSS 7.5
CVE-2026-84642 [HIGH] CWE-624 thunderbird: Allowed UNC hostnames for attachments interpreted as a regular expression
thunderbird: Allowed UNC hostnames for attachments interpreted as a regular expression
The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2.
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
The values of the mail.allowed_attachment_hostnames advanced config setting
were used in a regular expression without escaping. For some possible valid
hostnames, this could allow certain unintended hostnames to also match and
serve remote attachments.
Statement: Red Hat Product
Mozilla
Mozilla Foundation Security Advisory 2026-86: CVE-2026-84642
vendor_mozilla
CVE-2026-84642 Mozilla Foundation Security Advisory 2026-86: CVE-2026-84642
Mozilla Foundation Security Advisory 2026-86
CVE: CVE-2026-84642
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 155
Mozilla
Mozilla Foundation Security Advisory 2026-88: CVE-2026-84642
vendor_mozilla
CVE-2026-84642 Mozilla Foundation Security Advisory 2026-88: CVE-2026-84642
Mozilla Foundation Security Advisory 2026-88
CVE: CVE-2026-84642
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 153.2
GHSA
The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping.
ghsa_unreviewed·2026-09-02
CVE-2026-84642 The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping.
The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2.
VulDB
Mozilla Thunderbird up to 153.1/154 Attachment Hostname Matching incorrect regex (EUVD-2026-69711)
vuldb·2026-09-01
CVE-2026-84642 [CRITICAL] Mozilla Thunderbird up to 153.1/154 Attachment Hostname Matching incorrect regex (EUVD-2026-69711)
A vulnerability, which was classified as critical, has been found in Mozilla Thunderbird up to 153.1/154. Affected by this issue is some unknown functionality of the component Attachment Hostname Matching. The manipulation leads to incorrect regular expression.
This vulnerability is uniquely identified as CVE-2026-84642. The attack is possible to be carried out remotely. No exploit exists.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
2026-09-01
Published