--- id: CVE-2026-100766 title: 'Information disclosure in the Networking: JAR component' summary: >- Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. severity: medium cvss: 4.3 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N' cwe: - CWE-200 vendor: mozilla product: firefox affected: - firefox < 115.42.0 - 'firefox >= 116.0.0, < 140.17.0' - 'firefox >= 141.0.0, < 153.4.0' - 'firefox >= 154.0.0, < 157.0.0' - thunderbird < 140.17.0 - 'thunderbird >= 141.0, < 153.4.0' - 'thunderbird >= 154.0, < 157.0' patched: - firefox 157.0.0 - thunderbird 157.0 published: '2026-09-29' updated: '2026-10-13' sourceUpdated: '2026-10-13T18:00:56.640' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100766' references: - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2061526' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-100/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-101/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-103/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-97/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-98/' label: security@mozilla.org - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/' label: security@mozilla.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100766.json - url: 'https://access.redhat.com/security/cve/CVE-2026-100766' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2543125' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-100766' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100766' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-102/#CVE-2026-100766' - url: 'https://www.mozilla.org/security/advisories/mfsa2026-99/#CVE-2026-100766' - url: 'https://access.redhat.com/errata/RHSA-2026:85240' - url: 'https://access.redhat.com/errata/RHSA-2026:76764' - url: 'https://access.redhat.com/errata/RHSA-2026:80674' - url: 'https://access.redhat.com/errata/RHSA-2026:76850' - url: 'https://access.redhat.com/errata/RHSA-2026:85243' - url: 'https://access.redhat.com/errata/RHSA-2026:85242' - url: 'https://access.redhat.com/errata/RHSA-2026:85241' - url: 'https://access.redhat.com/errata/RHSA-2026:85244' - url: 'https://access.redhat.com/errata/RHSA-2026:76761' - url: 'https://access.redhat.com/errata/RHSA-2026:80694' tags: - nvd - cve.org - csaf - vex - red-hat - score-dispute epss: 0.00251 epssPercentile: 0.16432 ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-09-29T15:09:26.697827Z' ingestedAt: '2026-09-29T13:34:31.656Z' scores: nvd: 4.3 vendor: 7.5 --- ## Overview Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. ## Affected - `firefox < 115.42.0` - `firefox >= 116.0.0, < 140.17.0` - `firefox >= 141.0.0, < 153.4.0` - `firefox >= 154.0.0, < 157.0.0` - `thunderbird < 140.17.0` - `thunderbird >= 141.0, < 153.4.0` - `thunderbird >= 154.0, < 157.0` ## Remediation Upgrade past the affected range: - `firefox 157.0.0` - `thunderbird 157.0` ## Vendor advisories - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100766.json) - **RHSA-2026:85240** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85240) - **RHSA-2026:76764** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76764) - **RHSA-2026:80674** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80674) - **RHSA-2026:76850** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76850) - **RHSA-2026:85243** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85243) - **RHSA-2026:85242** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85242) - **RHSA-2026:85241** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85241) - **RHSA-2026:85244** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85244) - **RHSA-2026:76761** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:76761) - **RHSA-2026:80694** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80694)