CVE-2026-57962
thunderbird: Thunderbird: Denial of Service via malicious LDAP server
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 1, 2026
Updated · July 22, 2026
Description
A flaw was found in Thunderbird. A remote attacker, by operating a malicious Lightweight Directory Access Protocol (LDAP) server, can cause a Thunderbird client to crash due to memory exhaustion. This occurs when a user's Thunderbird client is configured to query the malicious LDAP server for address-book autocomplete, allowing the server to send an excessive amount of data. This can lead to a Denial of Service (DoS) for the affected user.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-1050 · Excessive Platform Resource Consumption within a Loop