Performance Degradation in Thunderbird Due to Malicious SOAP Responses from Compromised Servers
CVE-2026-110249

Currently unrated

Key Information:

Vendor

Mozilla
Status
Thunderbird
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110249?

A vulnerability exists in Thunderbird where a compromised Exchange server can return a specially crafted SOAP response. This response may contain numerous attributes that can cause Thunderbird's main thread to become CPU-bound, leading to severe performance degradation lasting from seconds to hours. Users should ensure they are running the latest versions, Thunderbird 158 or 153.5, to mitigate this issue.

Affected Version(s)

Thunderbird 153.5

Thunderbird 158

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2077826
https://www.mozilla.org/security/advisories/mfsa2026-109/
https://www.mozilla.org/security/advisories/mfsa2026-110/

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SuyZ
.