---
id: CVE-2025-8036
title: Thunderbird cached CORS preflight responses across IP address changes
summary: >-
  Thunderbird cached CORS preflight responses across IP address changes. This
  allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in
  Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-350
vendor: mozilla
product: firefox
affected:
  - firefox < 140.1.0
  - firefox < 141.0
  - thunderbird < 140.1.0
  - thunderbird < 141.0
patched:
  - firefox 141.0
  - thunderbird 141.0
published: '2025-07-22'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T15:10:00.590'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-8036'
references:
  - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=1960834'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2025-56/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2025-59/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2025-61/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2025-63/'
    label: security@mozilla.org
  - url: 'https://www.kb.cert.org/vuls/id/652514'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00446
epssPercentile: 0.38591
ingestedAt: '2026-09-30T18:17:24.449Z'
---

## Overview

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

## Affected

- `firefox < 140.1.0`
- `firefox < 141.0`
- `thunderbird < 140.1.0`
- `thunderbird < 141.0`

## Remediation

Upgrade past the affected range:

- `firefox 141.0`
- `thunderbird 141.0`