Memory Exhaustion via LDAP in Thunderbird <152.0.1 (pre-fix)
CVE-2026-57962 Published on July 1, 2026
Denial-of-service via malicious LDAP address-book server
A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.
Vulnerability Analysis
CVE-2026-57962 is exploitable with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2026-57962 has been classified to as a Resource Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-57962
Want to know whenever a new CVE is published for Mozilla Thunderbird? stack.watch will email you.
Affected Versions
Mozilla Thunderbird:- Version 140.12.1, <= 140.* is unaffected.
- Version 152.0.1, <= * is unaffected.