CVE-2020-26961

When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

• https://bugzilla.mozilla.org/show_bug.cgi?id=1672528Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-50/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-51/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-52/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1672528Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-50/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-51/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-52/Vendor Advisory

Published

Dec 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26956In some cases, removing HTML elements during sanitization wo…6.1
• CVE-2020-26957OneCRL was non-functional in the new Firefox for Android due…6.5
• CVE-2020-26958Firefox did not block execution of scripts with incorrect MI…6.1
• CVE-2020-26959During browser shutdown, reference decrementing could have o…8.8
• CVE-2020-2696Vulnerability in the Oracle Solaris product of Oracle System…8.8
• CVE-2020-26960If the Compact() method was called on an nsTArray, the array…8.8
• CVE-2020-26962Cross-origin iframes that contained a login form could have …6.1
• CVE-2020-26963Repeated calls to the history and location interfaces could …4.3
• CVE-2020-26964If the Remote Debugging via USB feature was enabled in Firef…6.8
• CVE-2020-26965Some websites have a feature "Show Password" where clicking …6.5
• CVE-2020-26966Searching for a single word from the address bar caused an m…6.5
• CVE-2020-26967When listening for page changes with a Mutation Observer, a …6.5