CVE-2026-110249

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.

• https://bugzilla.mozilla.org/show_bug.cgi?id=2077826
• https://www.mozilla.org/security/advisories/mfsa2026-109/
• https://www.mozilla.org/security/advisories/mfsa2026-110/

Published

Oct 13, 2026

Last Modified

Oct 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-110238Rapyd Admin from 9.0.0 before 9.20.0 contains an authorizati…8.8
• CVE-2026-110239Rapyd Admin before 9.20.0 contains a stored cross-site scrip…4.4
• CVE-2026-11024Stack buffer overflow in Skia in Google Chrome prior to 149.…8.8
• CVE-2026-110240Lancet through 2.3.9 contains an SSRF protection bypass vuln…4.8
• CVE-2026-110247Several buffer-growth sites in libmime performed size arithm…
• CVE-2026-110248Insertion of sensitive information into log files in the git…5.3
• CVE-2026-11025Insufficient policy enforcement in Navigation in Google Chro…6.5
• CVE-2026-110252The WPeMatico RSS Feed Fetcher plugin for WordPress is vulne…5.4
• CVE-2026-110253The weForms – Easy Drag & Drop Contact Form Builder For Word…5.4
• CVE-2026-110254Finsys Dockhand before 1.0.45 contains a server-side request…4.3
• CVE-2026-110255Finsys Dockhand before 1.0.43 contains a response-disclosing…8.5
• CVE-2026-110256Finsys Dockhand through 1.0.18 contains an LDAP injection vu…3.7